CVE-2026-24846

The record

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.

Affected packages

Related vulnerabilities

• GO-2026-4391 malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in… Same vulnerability
• GHSA-945p-3jhm-6rcp malcontent: Nested archive extraction failure can drop content from scan inputs Also affects github.com/chainguard-dev/malcontent
• CVE-2026-28407 malcontent is software for discovering supply-chain compromises through context… Also affects github.com/chainguard-dev/malcontent
• GO-2026-4392 malcontent OCI image pull credential exfiltration via malicious registry token realm in… Also affects github.com/chainguard-dev/malcontent
• CVE-2026-24845 malcontent discovers supply-chain compromises through. Also affects github.com/chainguard-dev/malcontent
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb