CVE-2026-44971: falha de alta gravidade em DataDog guarddog
GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.2%
GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog. This vulnerability is fixed in .
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
DataDog · guarddogCVEs relacionadas — DataDog guarddog
No mesmo produto, das mais perigosas para as menos.
CVE-2026-22871HIGHGuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCEEPSS 1.1%CVE-2022-23530MEDIUMGuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI packageEPSS 0.8%CVE-2022-23531MEDIUMArbitrary file write when scanning a specially-crafted local PyPI packageEPSS 0.7%CVE-2026-22870HIGHGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoSEPSS 0.5%CVE-2026-44972MEDIUMGuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentEPSS 0.1%