Medium severity5.8NVD Advisory· Published Dec 17, 2022· Updated Jun 17, 2026
CVE-2022-23531
CVE-2022-23531
Description
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
guarddogPyPI | < 0.1.5 | 0.1.5 |
Affected products
3Patches
Vulnerability mechanics
References
8- github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306nvdPatchThird Party Advisory
- github.com/DataDog/guarddog/releases/tag/v0.1.5nvdRelease NotesThird Party AdvisoryWEB
- github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vqnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-rp2v-v467-q9vqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-23531ghsaADVISORY
- github.com/DataDog/guarddog/commit/98af5c8c1e9c15fa888c900252e76116b0ec25d1ghsaWEB
- github.com/DataDog/guarddog/pull/89ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/guarddog/PYSEC-2022-42994.yamlghsaWEB
News mentions
0No linked articles in our index yet.