CVE-2026-22871
published 2026-01-13CVE-2026-22871: GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract()…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.95%
56.6th percentile
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| datadog | guarddog | < 2.7.1 | 2.7.1 |
| datadog | guarddog | >= 0 < 2.7.1 | 2.7.1 |
| datadoghq | guarddog | < 2.7.1 | 2.7.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
osv·2026-01-13
CVE-2026-22871 [HIGH] GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
## Summary
A **path traversal vulnerability** exists in GuardDog's `safe_extract()` function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to **Arbitrary File Overwrite** and **Remote Code Execution** on systems running GuardDog.
**CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
## Details
### Vulnerable Code
**File:** `guarddog/utils/archives.py`
```python
elif zipfile.is_zipfile(source_archive):
with zipfile.ZipFile(source_archive, "r") as zip:
for file in zip.namelist():
# Note: zip.extract cleans up any malicious file name
# such as directory traversal attempts This is not the
# case of zipfile.extractall
zi
GHSA
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
ghsa·2026-01-13
CVE-2026-22871 [HIGH] CWE-22 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
## Summary
A **path traversal vulnerability** exists in GuardDog's `safe_extract()` function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to **Arbitrary File Overwrite** and **Remote Code Execution** on systems running GuardDog.
**CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
## Details
### Vulnerable Code
**File:** `guarddog/utils/archives.py`
```python
elif zipfile.is_zipfile(source_archive):
with zipfile.ZipFile(source_archive, "r") as zip:
for file in zip.namelist():
# Note: zip.extract cleans up any malicious file name
# such as directory traversal attempts This is not the
# case of zipfile.extractall
zi
No detection rules found.
No public exploits indexed.
2026-01-13
Published