Vulnerability · Published Feb 27, 2026 · Assigned by GitHub_M
CVE-2026-28407malcontent's nested archive extraction failure can drop content from scan inputs
Medium 6.9
In plain English
A medium-severity security flaw in malcontent from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/chainguard-dev/malcontent | 1.21.0 | GHSA-945p-3jhm-6rcp |
| Go | github.com/chainguard-dev/malcontent | 1.21.0 | GO-2026-4577 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | malcontent | < 1.21.0 |
Weakness: CWE-703 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N