Skip to content
Threat Feed
Subscribe

Tag

Integrity-Bypass

1 brief RSS
high advisory

Incomplete Package Integrity Verification in Chainguard apko and melange Allows Data Section Substitution

A critical vulnerability, CVE-2026-54174, in Chainguard's apko and melange packages allows attackers to substitute arbitrary file contents within packages due to incomplete integrity verification, potentially leading to remote code execution.

apko +1 supply-chain package-manager integrity-bypass remote-code-execution defense-evasion
2t