Medium severity · published Jul 18, 2025
CVE-2025-54059
melange creates SBOM files in APKs with world-writable permissions
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
melange · chainguard-dev
>= 0.23.0, < 0.29.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54059
github.com
https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04
github.com
https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1
github.com
https://github.com/chainguard-dev/melange/pull/1836
github.com
https://github.com/chainguard-dev/melange/pull/2086
github.com
https://github.com/chainguard-dev/melange/releases/tag/v0.23.0
github.com
https://github.com/chainguard-dev/melange/releases/tag/v0.29.5
More from melange
8.8
CVE-2026-24844
melange pipeline working-directory could allow command injection
8.4
CVE-2026-24843
melange QEMU runner could write files outside workspace directory
8.3
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
7.8
CVE-2026-25143
melange affected by potential host command execution via license-check YAML mode patch pipeline
6.1
CVE-2026-29050
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses