GHSA-945p-3jhm-6rcpMedium

malcontent: Nested archive extraction failure can drop content from scan inputs

Published
February 28, 2026
Last Modified
February 28, 2026

🔗 CVE IDs covered (1)

📋 Description

Previously, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes.

Fix: https://github.com/chainguard-dev/malcontent/pull/1383

Acknowledgements

malcontent thanks Oleh Konko from 1seal for discovering and reporting this issue.

🎯 Affected products1

  • go/github.com/chainguard-dev/malcontent:< 1.21.0

🔗 References (5)