Melange, a tool for building APK packages from declarative pipelines, has a flaw in how it handles the working-directory field. From version 0.3.0 to 0.40.2 an attacker who can supply build input values but cannot edit the pipeline definition can inject arbitrary shell commands. The vulnerable field is inserted into shell scripts without quote escaping, allowing command substitution and execution. This weakness is a classic System Call Injection (CWE‑78) and enables an attacker to run arbitrary commands during the build process.

The affected product is Chainguard Dev's Melange, versions 0.3.0 through 0.40.2 inclusive. Build inputs from an untrusted source can trigger the injection when the pipeline references ${{vars.*}} or ${{inputs.*}} within the working-directory parameter. The patch, released in version 0.40.3, corrects the escaping logic.

The CVSS score is 7.8, indicating high severity. The EPSS score is <1%, suggesting a low probability of exploitation under current conditions, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only to supply malicious input values to an automated build; no control over pipeline code is required. The build system must run with sufficient privileges for the exploit to be valuable, but the flaw does not require user interaction beyond providing allowed inputs.