CVE-2026-22871

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22871", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-12T16:20:16.747Z", "datePublished": "2026-01-13T20:46:57.324Z", "dateUpdated": "2026-01-13T21:24:07.742Z"}, "containers": {"cna": {"title": "GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/DataDog/guarddog/security/advisories/GHSA-xg9w-vg3g-6m68", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-xg9w-vg3g-6m68"}, {"name": "https://github.com/DataDog/guarddog/commit/9aa6a725b2c71d537d3c18d1c15621395ebb879c", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/guarddog/commit/9aa6a725b2c71d537d3c18d1c15621395ebb879c"}], "affected": [{"vendor": "DataDog", "product": "guarddog", "versions": [{"version": "< 2.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T20:46:57.324Z"}, "descriptions": [{"lang": "en", "value": "GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1."}], "source": {"advisory": "GHSA-xg9w-vg3g-6m68", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T21:23:35.718154Z", "id": "CVE-2026-22871", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T21:24:07.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22871", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T21:23:35.718154Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T21:24:03.402Z"}}], "cna": {"title": "GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE", "source": {"advisory": "GHSA-xg9w-vg3g-6m68", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "DataDog", "product": "guarddog", "versions": [{"status": "affected", "version": "< 2.7.1"}]}], "references": [{"url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-xg9w-vg3g-6m68", "name": "https://github.com/DataDog/guarddog/security/advisories/GHSA-xg9w-vg3g-6m68", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DataDog/guarddog/commit/9aa6a725b2c71d537d3c18d1c15621395ebb879c", "name": "https://github.com/DataDog/guarddog/commit/9aa6a725b2c71d537d3c18d1c15621395ebb879c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T20:46:57.324Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22871", "state": "PUBLISHED", "dateUpdated": "2026-01-13T21:24:07.742Z", "dateReserved": "2026-01-12T16:20:16.747Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-13T20:46:57.324Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "guarddog", "vendor": "DataDog", "versions": [{"status": "affected", "version": "< 2.7.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:datadoghq:guarddog:*:*:*:*:*:python:*:*", "matchCriteriaId": "872A0822-90B4-4E21-985F-788BE44CA582", "versionEndExcluding": "2.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1."}, {"lang": "es", "value": "GuardDog es una herramienta CLI para identificar paquetes PyPI maliciosos. Antes de la versi\u00f3n 2.7.1, existe una vulnerabilidad de salto de ruta en la funci\u00f3n safe_extract() de GuardDog que permite a paquetes PyPI maliciosos escribir archivos arbitrarios fuera del directorio de extracci\u00f3n previsto, lo que lleva a una Sobreescritura de Archivos Arbitrarios y Ejecuci\u00f3n Remota de C\u00f3digo en sistemas que ejecutan GuardDog. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.7.1."}], "id": "CVE-2026-22871", "lastModified": "2026-06-17T10:20:32.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22871", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T21:23:35.718154Z", "version": "2.0.3"}}]}, "published": "2026-01-13T21:15:55.210", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/DataDog/guarddog/commit/9aa6a725b2c71d537d3c18d1c15621395ebb879c"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-xg9w-vg3g-6m68"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:27:40.108324+00:00", "value": {"mitigation_remediation": ["Update GuardDog to version 2.7.1 or later. ", "Restrict GuardDog\u2019s execution to users with minimal permissions to prevent the attack from affecting critical system files. ", "Validate or avoid extraction of unknown PyPI packages and enforce strict path checks to prevent traversal attacks."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is DataDog GuardDog, a Python-based CLI tool. All releases prior to version 2.7.1 are vulnerable; users must ensure they are not running any older revision.", "description_and_impact": "GuardDog is a CLI utility used to scan PyPI packages for malicious content. A vulnerability in the safe_extract() function allows an attacker to craft a malicious package that, when processed by GuardDog, writes files outside the intended extraction directory. This leads to arbitrary file overwrite, which can compromise system files or execute arbitrary code, resulting in full system takeover on machines running GuardDog.", "risk_and_exploitability": "The CVSS score is 8.7, indicating high severity, while the EPSS score is less than 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be a local user or process that supplies a malicious PyPI package to GuardDog, which then extracts files beyond the intended directory, leading to overwrite and execution of malicious code."}}}}, "created": "2026-01-14T11:08:25.620544+00:00", "updated": "2026-04-18T06:30:25.912470+00:00", "vendors": ["datadoghq", "datadoghq$PRODUCT$guarddog"]}