CVE-2026-24846
Description
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.
How to fix
- chainguard malcontent1.20.3 or later
- github.com/chainguard-dev/malcontent1.20.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chainguard malcontent | 1.8.0 ≤ v < 1.20.3 | 1.20.3 |
| github.com/chainguard-dev/malcontentGo | 1.8.0 ≤ v < 1.20.3 | 1.20.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.