Symlink Vulnerability in Malcontent Affecting Supply Chain Security

CVE-2026-24846

What is CVE-2026-24846?

Malcontent, a tool for supply chain security, has identified a vulnerability that allows the creation of symbolic links outside the specified extraction directory when processing specially crafted tar or deb archives. The flaw lies in the improper handling of arguments within the handleSymlink function, which led to symlink targets being incorrectly used as the symlink location. Furthermore, symlink targets were not adequately validated, posing a risk of exposure to unintended directories. Version 1.20.3 includes essential fixes, including a swap of arguments in the handleSymlink function, as well as enhanced validation checks to ensure that symlink targets resolve correctly within the intended extraction directory.

References