Melange, a tool for building Android package files from declarative pipelines, contains a path‑traversal flaw in the LicenseInfos function. The function reads license files listed in copyright[].license-path without enforcing that the file lies inside the build workspace. An attacker who can influence a melange configuration file—such as by submitting a pull request or manipulating a build‑as‑a‑service environment—can supply a path containing “../” sequences that point to arbitrary files on the host system. The contents of those files are then embedded into the generated Software Bill of Materials as license text, allowing the attacker to exfiltrate sensitive data. This weakness is a classic input validation issue identified as CWE‑22 and results in accidental disclosure of confidential host files.

The vulnerability affects all releases of chainguard‑dev’s melange from version 0.14.0 through 0.40.2, inclusive. The issue was fixed in version 0.40.3. Therefore any component or pipeline that pulls a melange image older than 0.40.3 and accepts untrusted configuration inputs is vulnerable.

The CVSS score for this issue is 5.5, reflecting a medium‑severity information‑disclosure risk. The EPSS score is below 1 %, indicating a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploits. Attackers will need the ability to modify or influence the melange configuration file, which is common in CI pipelines that merge code from external contributors. Once the configuration is accepted, the attacker can read arbitrary host files and embed them into the resulting SBOM, achieving data exfiltration without further elevation. The low EPSS and lack of known exploits mean the immediacy of risk is moderate, but the potential impact on confidentiality warrants timely remediation.