QwikSec

Security Database

CVE

CWE

Training

CVE-2026-22871

Published: Jan 13, 2026

Modified: Jan 13, 2026

PUBLISHED

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.

Vendor	Product	Versions
DataDog	guarddog	affected `< 2.7.1`

Weaknesses (CWE)

References

https://github.com/DataDog/guarddog/security/advisories/GHSA-xg9w-vg3g-6m68

x_refsource_CONFIRM

https://github.com/DataDog/guarddog/commit/9aa6a725b2c71d537d3c18d1c15621395ebb879c

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.