CVE-2026-22871

CRITICAL

GuardDog < 2.7.1 - Path Traversal and Arbitrary File Overwrite via safe_extract()

Title source: llm
STIX 2.1

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0024
EPSS Percentile 46.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (2)
datadoghq/guarddog < 2.7.1
pypi/guarddog 0 - 2.7.1PyPI
Published Jan 13, 2026
Tracked Since Feb 18, 2026