CVE-2026-22871: fallo de gravedad alta en DataDog guarddog
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 1.1%
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
DataDog · guarddogCVEs relacionadas — DataDog guarddog
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23530MEDIUMGuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI packageEPSS 0.8%CVE-2022-23531MEDIUMArbitrary file write when scanning a specially-crafted local PyPI packageEPSS 0.7%CVE-2026-22870HIGHGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoSEPSS 0.5%CVE-2026-44971HIGHGuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationEPSS 0.2%CVE-2026-44972MEDIUMGuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentEPSS 0.1%