malcontent: Nested archive extraction failure can drop content from scan inputs

TRUNG BÌNH 5.3CVE-2026-28407 · GHSA-945p-3jhm-6rcp · GO-2026-4577 · Công bố 27/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-28407 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng github.com/chainguard-dev/malcontent, malcontent (chainguard).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.41%, cao hơn 35.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.21.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/chainguard-dev/malcontent Go	`< 1.21.0`	`1.21.0`
malcontent chainguard	`< 1.21.0`	`1.21.0`

Mô tả

Previously, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes.

Fix: https://github.com/chainguard-dev/malcontent/pull/1383

Acknowledgements

malcontent thanks Oleh Konko from 1seal for discovering and reporting this issue.

Mô tả của NVD

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.