CVE-2026-22871: high-severity vulnerability in DataDog guarddog
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 1.1%
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
DataDog · guarddogRelated CVEs — DataDog guarddog
In the same product, most dangerous first.
CVE-2022-23530MEDIUMGuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI packageEPSS 0.8%CVE-2022-23531MEDIUMArbitrary file write when scanning a specially-crafted local PyPI packageEPSS 0.7%CVE-2026-22870HIGHGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoSEPSS 0.5%CVE-2026-44971HIGHGuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationEPSS 0.2%CVE-2026-44972MEDIUMGuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentEPSS 0.1%