Skip to content
OpenAdvisories

Product · chainguard-dev

malcontent

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-28407

    malcontent's nested archive extraction failure can drop content from scan inputs

    malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A bette…

    chainguard-dev malcontent github.com/chainguard-dev/malcontent Go
  • Medium 5.5
    CVE-2026-24846

    malcontent's archive extraction could write outside extraction directory

    malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a speci…

    chainguard-dev malcontent github.com/chainguard-dev/malcontent Go
  • Medium 6.5
    CVE-2026-24845

    malcontent's OCI image scanning could expose registry credentials

    malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image…

    chainguard-dev malcontent github.com/chainguard-dev/malcontent github.com/chainguard-dev/bincapz Go