VYPR
← All advisories
High severityOSV Advisory· Published Jan 13, 2026· Updated Jan 13, 2026

GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE

CVE-2026-22871

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
guarddogPyPI
< 2.7.12.7.1

Affected products

1

Patches

1
9aa6a725b2c7

Merge pull request #644 from ejortega/zip-duplicate-path

https://github.com/DataDog/guarddogsobregosoddJan 9, 2026via ghsa
commit
1 file changed · +1 −1
  • guarddog/utils/archives.py+1 −1 modified
    @@ -74,6 +74,6 @@ def recurse_add_perms(path):
                 # Note: zip.extract cleans up any malicious file name
                 # such as directory traversal attempts This is not the
                 # case of zipfile.extractall
-                zip.extract(file, path=os.path.join(target_directory, file))
+                zip.extract(file, path=target_directory)
     else:
         raise ValueError(f"unsupported archive extension: {source_archive}")

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.