CVE-2026-28407
malcontent's nested archive extraction failure can drop content from scan inputs
概要
malcontent's nested archive extraction failure can drop content from scan inputs
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com