CVE-2026-28407: 
NixOS vulnerability analysis and mitigation

CVE-2026-28407 is a vulnerability in malcontent, an open-source supply-chain security tool by Chainguard that uses context, differential analysis, and YARA rules to detect compromises. Prior to version 1.21.0, malcontent would silently delete nested archives that failed to extract during scanning, potentially allowing malicious content embedded in those archives to evade detection entirely. The vulnerability was discovered by Oleh Konko from 1seal and disclosed on February 27, 2026. It affects all versions of github.com/chainguard-dev/malcontent before 1.21.0 and carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, Chainguard Advisory).

The root cause is classified as CWE-703 (Improper Check or Handling of Exceptional Conditions): when extractNestedArchive() in pkg/archive/archive.go encountered an extraction error, it would log a debug-level message and then unconditionally call os.Remove() on the archive file, deleting it regardless of whether extraction succeeded. This meant that a crafted nested archive — for example, a .tar.gz file containing valid gzip bytes but invalid tar content — would trigger an extraction failure, causing malcontent to silently discard the file rather than scanning its raw bytes. The fix (PR #1383, commit 356c566) changes the logic so that os.Remove() is only called on successful extraction; failed archives are retained and subjected to a best-effort byte-level scan, and the log level is elevated from debug to warning (Chainguard Advisory, Fix Commit).

The primary impact is an integrity/detection gap: attackers who can introduce packages into a supply chain can craft nested archives designed to fail extraction, causing malcontent to drop the malicious content from its scan scope entirely and produce no findings. This enables supply-chain compromise detection evasion — compromised packages could persist undetected in environments relying on malcontent for security scanning. There is no direct confidentiality or availability impact to the host system; the harm is to the trustworthiness of the scanning process itself (GitHub Advisory, Chainguard Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.036% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to be able to introduce a specially crafted nested archive into a supply chain or artifact repository that is subsequently scanned by a vulnerable version of malcontent (GitHub Advisory).

1. Craft a malicious nested archive: Create an outer archive (e.g., outer.tar.gz) containing a nested file with an archive extension (e.g., bad_nested.tar.gz) whose content is valid gzip but invalid tar — ensuring it will fail extraction. Embed malicious content (e.g., a backdoor script or malicious binary) within the gzip stream.
2. Introduce the archive into the target supply chain: Upload the crafted package to a registry, repository, or artifact store that is monitored by a vulnerable malcontent instance (versions < 1.21.0).
3. Trigger a malcontent scan: Wait for or trigger a malcontent scan of the repository or artifact. When malcontent processes the outer archive, it will attempt to extract the nested bad_nested.tar.gz.
4. Extraction failure causes deletion: The nested archive fails to extract; malcontent logs a debug message and calls os.Remove() on the nested file, silently deleting it from the scan working directory.
5. Malicious content evades detection: The malicious content within the failed nested archive is never scanned, producing no YARA or behavioral findings. The compromised package passes the supply-chain security check undetected (Chainguard Advisory, Fix Commit).

• Logs: In malcontent versions < 1.21.0, extraction failures for nested archives are logged only at DEBUG level (message: ignoring extraction error for <file>: <error>); absence of warnings about nested archive failures during scans of complex archives may indicate the vulnerable behavior. In version ≥ 1.21.0, a WARN-level message extraction failed for <file>, retaining archive for scanning: <error> is emitted for each failed nested archive.
• File System: During scanning with vulnerable versions, nested archive files (e.g., *.tar.gz, *.zip inside outer archives) that fail extraction will be absent from the malcontent temporary extraction directory, whereas in patched versions they are retained for scanning.
• Scan Results: Unexpectedly clean scan results for packages known to contain nested or complex archive structures may warrant re-scanning with a patched version of malcontent (Fix Commit, Chainguard Advisory).

Upgrade malcontent to version 1.21.0 or later, which fixes the issue by preserving nested archives that fail to extract and performing a best-effort byte-level scan on them instead of deleting them. No configuration-based workaround is available for versions prior to 1.21.0. Organizations using malcontent as part of their supply-chain security pipeline should treat this update as a priority to prevent detection evasion. The fix was merged on February 17, 2026 (PR #1383) and released as part of version 1.21.0 (GitHub Advisory, Fix PR).