CVE-2022-23531: Datadoghq Guarddog

High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days.

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

Affected products

• Datadoghq Guarddog: before 0.1.5 (fixed in 0.1.5)

Published 2022-12-17. Last modified 2026-06-17.