Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-29 | 1 | Disclosure1 |
| 2026-01-30 | 1 | General1 |
CVE-2026-24846 Symlink Vulnerability in Malcontent Supply Chain Analysis Tool 1.8.0-1.20.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24846
Post summary
The text cites a CVE for a symlink vulnerability in Malcontent Supply Chain Analysis Tool and links to a database entry, but does not provide actionable details, PoC, exploits, or patch information.
CVE-2026-24846 malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent cou… https://www.cve.org/CVERecord?id=CVE-2026-24846
Post summary
A new supply‑chain vulnerability (CVE-2026-24846) in malcontent versions 1.8.0 through 1.20.3 is identified, leveraging context analysis and YARA, with no PoC, patch, or active exploitation reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chainguard | malcontent | - | - | - |