GO-2026-4391
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction in github.com/chainguard-dev/malcontent
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/chainguard-dev/malcontent | 1.8.0 | 1.20.3 |
| go | github.com/chainguard-dev/malcontent | 1.8.0 | 1.20.3 |
Related vulnerabilities
- CVE-2026-24846 malcontent discovers supply-chain compromises through. Same vulnerability
- GHSA-945p-3jhm-6rcp malcontent: Nested archive extraction failure can drop content from scan inputs Also affects github.com/chainguard-dev/malcontent
- CVE-2026-28407 malcontent is software for discovering supply-chain compromises through context… Also affects github.com/chainguard-dev/malcontent
- GO-2026-4392 malcontent OCI image pull credential exfiltration via malicious registry token realm in… Also affects github.com/chainguard-dev/malcontent
- CVE-2026-24845 malcontent discovers supply-chain compromises through. Also affects github.com/chainguard-dev/malcontent