This vulnerability occurs in the melange build tool when the optional flag --persist-lint-results is enabled. In versions 0.32.0 through 0.43.4, melange constructs output file paths by concatenating the user-specified --out-dir directory with the package architecture and name extracted from a maliciously crafted .PKGINFO file. Because these values are not validated for path separators or directory traversal sequences, an attacker who can supply a forged APK to the lint or build process can cause the tool to write a JSON lint report to an arbitrary location within the filesystem accessible to melange. The written content is partially influenced by the attacker, allowing potential overwrite of other JSON artifacts, but there is no direct code‑execution path.

Chainguard Dev's melange, versions 0.32.0 up to but not including 0.43.4, when the --persist-lint-results flag is enabled.

The CVSS v3.1 score of 4.4 reflects a medium severity due to limited impact; the EPSS score is under 1%, indicating a very low probability that exploitation will occur. The vulnerability does not provide privilege escalation or remote code execution, but it can lead to destructive file overwrite within an environment that trusts the build pipeline. The attack would need an adversary who can influence the .PKGINFO of an APK processed by a melange instance, such as an insecure CI pipeline that lints third-party APKs. The issue is not listed in CISA’s KEV catalog, and no public exploit has been reported.