Security readout for executives and security teams
Plain-English summary
CVE-2026-28407 affects malcontent, a tool used to detect supply-chain compromises. Before version 1.21.0, if a nested archive failed to extract, malcontent removed it from scan inputs. That could allow suspicious content inside the archive to be missed. This is a detection-gap issue, not direct code execution.
Executive priority
Prioritize where malcontent informs release, package intake, or incident triage decisions. This does not appear to enable direct system compromise, but it can weaken supply-chain detection confidence. Upgrade during the next security maintenance window, sooner for critical scanning pipelines.
Technical view
Affected malcontent versions before 1.21.0 mishandle nested archive extraction failures. Instead of preserving failed nested archives for best-effort byte scanning, the tool removes them, potentially excluding malicious content from analysis. The CVE maps to CWE-703 and has CVSS 4.0 score 6.9. Version 1.21.0 fixes the behavior.
Likely exposure
Exposure is limited to organizations using malcontent versions earlier than 1.21.0, especially in supply-chain scanning, package review, or CI security workflows that process nested archives.
Exploitation context
No source in the bundle reports active exploitation, and the CVE is not marked KEV. The risk is that crafted or problematic nested archives could reduce scanner coverage and create false negatives during malware or supply-chain compromise detection.
Researcher notes
The key behavior change is preservation of failed nested archives for best-effort scanning instead of removal. Public sources identify the affected range as prior to 1.21.0 and the fix in 1.21.0. Evidence does not include exploit details or active exploitation claims.
Mitigation direction
- Upgrade malcontent to version 1.21.0 or later.
- Review vendor advisory and release notes before deployment.
- Re-scan high-risk artifacts previously analyzed with affected versions.
- Check CI and security-tooling images for embedded vulnerable malcontent versions.
Validation and detection
- Inventory malcontent installations and confirm versions are 1.21.0 or later.
- Review scan logs for nested archive extraction failures in prior analyses.
- Confirm updated scans preserve or best-effort analyze failed nested archives.
- Validate container images or build runners do not pin malcontent below 1.21.0.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-703: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28407 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-945p-3jhm-6rcpCVE reference · x_refsource_CONFIRM
- https://github.com/chainguard-dev/malcontent/pull/1383CVE reference · x_refsource_MISC
- https://github.com/chainguard-dev/malcontent/commit/356c56659ccfcad0b249a97de8cf71f151ed3ee9CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Check or Handling of Exceptional Conditions
Improper Check or Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.