—
GO-2026-4392
malcontent OCI image pull credential exfiltration via malicious registry token realm in github.com/chainguard-dev/malcontent
Quick fix
GO-2026-4392 — github.com/chainguard-dev/malcontent: upgrade to the fixed version with the command below.
go get github.com/chainguard-dev/malcontent@v1.20.3Details
malcontent OCI image pull credential exfiltration via malicious registry token realm in github.com/chainguard-dev/malcontent
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/chainguard-dev/bincapz
Introduced in:
0.10.0No fixed version published yet for github.com/chainguard-dev/bincapz (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/chainguard-dev/malcontent
Introduced in:
0Fixed in: 1.20.3Fix
go get github.com/chainguard-dev/malcontent@v1.20.3