malcontent was designed to detect supply‑chain compromise by scanning archives for malicious patterns. The flaw caused failed extraction of nested archives to be silently removed, preventing those inner files from being examined. The result is that malicious content may pass undetected, reducing the tool’s effectiveness. This weakness is a failure to handle error conditions properly, categorized as CWE‑703.

The vulnerable software is Chainguard‑Dev Malcontent. All releases before 1.21.0 are affected. Versions 1.21.0 and later include the fix.

The vulnerability scores a CVSS of 6.9, indicating moderate risk. EPSS is less than 1 %, making exploitation unlikely. The flaw is not listed in the CISA KEV catalog. The attack vector is indirect: an adversary can craft an archive that contains a nested archive that fails to extract; malcontent will drop the content, allowing the malicious payload to evade detection. Because the flaw only causes missing detection and not direct code execution, the impact is limited to ineffective security monitoring rather than an immediate compromise.