High · published February 4, 2026
⚡ Attackers could run arbitrary commands just by manipulating build inputs! In versions 0.3.0 to before 0.40.3 of melange, an unsuspecting pipeline can turn into a hacker's playground. 🔥 Think of it like a restaurant order where the kitchen blindly follows any note on the ticket without checking the actual dish — if someone sneaks in a recipe for disaster, the kitchen serves up a big mess! An attacker can exploit this flaw to execute any shell command, potentially gaining full control over the build environment. This could lead to unauthorized access, data leaks, or even worse, allowing attackers to manipulate future builds. It's a high-stakes game where the consequences could be absolutely devastating!
Think of it like a restaurant order where the kitchen blindly follows any note on the ticket without checking the actual dish — if someone sneaks in a recipe for disaster, the kitchen serves up a big mess! This vulnerability arises because the ${{vars.*}} or ${{inputs.*}} substitutions in the working-directory are embedded into shell scripts without proper quote escaping, allowing attackers to inject their own commands. Thus, if they have access to build input values, the pipeline becomes a vector for arbitrary command execution.
An attacker can exploit this flaw to execute any shell command, potentially gaining full control over the build environment. This could lead to unauthorized access, data leaks, or even worse, allowing attackers to manipulate future builds. It's a high-stakes game where the consequences could be absolutely devastating! To protect your environment, upgrade melange to version 0.40.3 immediately. Additionally, review all pipeline definitions to ensure that user inputs are properly sanitized and escaped. Implementing stricter access controls on who can provide build inputs is also a wise move. You've got this! Follow these steps, and you'll keep your pipelines safe and sound. 🛡️