malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 27, 2026 · NIST NVD

   Detected

   malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the iss

2. Jun 17, 2026 · NIST NVD

   Updated

   malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the iss

Affected

• cpe chainguard/malcontentversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28407

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28407

  malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to pres

  nvd.nist.gov

References

• Patch · github.com
• Issue Tracking · github.com
• Patch · github.com