Supply Chain Compromise Risk in Malcontent Software by Chainguard

CVE-2026-28407

What is CVE-2026-28407?

Malcontent software, designed for identifying supply-chain compromises, has a security flaw prior to version 1.21.0 that affects its handling of nested archives. When these archives fail to extract, they may be removed, potentially leaving behind malicious content undetected. This vulnerability compromises the software's ability to effectively scan and analyze archive bytes for threats. The recommended update to version 1.21.0 resolves this issue by ensuring that these archives are preserved, allowing for a more thorough analysis and enhancing the overall security posture of users relying on malcontent.

References