Skip to content
OpenAdvisories

Package · PyPI

guarddog

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.2
    CVE-2026-44971

    GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

    GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with th…

    Datadog guarddog guarddog PyPI
  • Medium 5.0
    CVE-2026-44972

    GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

    GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A …

    Datadog guarddog guarddog PyPI
  • High 8.7
    CVE-2026-22871

    GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE

    GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction direc…

    Datadog guarddog guarddog PyPI
  • High 7.1
    CVE-2026-22870

    GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS

    GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bom…

    Datadog guarddog guarddog PyPI
  • Medium 5.8
    CVE-2022-23531

    Arbitrary file write when scanning a specially-crafted local PyPI package

    GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to w…

    Datadog guarddog guarddog PyPI
  • Medium 5.8
    CVE-2022-23530

    GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

    GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarb…

    Datadog guarddog guarddog PyPI