CVE-2026-28407

The record

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-945p-3jhm-6rcp malcontent: Nested archive extraction failure can drop content from scan inputs Same vulnerability
• GO-2026-4392 malcontent OCI image pull credential exfiltration via malicious registry token realm in… Also affects github.com/chainguard-dev/malcontent
• GO-2026-4391 malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in… Also affects github.com/chainguard-dev/malcontent
• CVE-2026-24846 malcontent discovers supply-chain compromises through. Also affects github.com/chainguard-dev/malcontent
• CVE-2026-24845 malcontent discovers supply-chain compromises through. Also affects github.com/chainguard-dev/malcontent
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb