CVE-2026-44972

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44972", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T16:23:33.263Z", "datePublished": "2026-05-27T14:42:00.807Z", "dateUpdated": "2026-05-27T15:34:32.271Z"}, "containers": {"cna": {"title": "GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr"}], "affected": [{"vendor": "DataDog", "product": "guarddog", "versions": [{"version": ">= 2.6.0, <= 2.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T14:42:00.807Z"}, "descriptions": [{"lang": "en", "value": "GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs."}], "source": {"advisory": "GHSA-m5p4-gvpx-4mvr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T15:34:24.334334Z", "id": "CVE-2026-44972", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T15:34:32.271Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44972", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T15:34:24.334334Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T15:34:28.544Z"}}], "cna": {"title": "GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content", "source": {"advisory": "GHSA-m5p4-gvpx-4mvr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "DataDog", "product": "guarddog", "versions": [{"status": "affected", "version": ">= 2.6.0, <= 2.9.0"}]}], "references": [{"url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr", "name": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T14:42:00.807Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44972", "state": "PUBLISHED", "dateUpdated": "2026-05-27T15:34:32.271Z", "dateReserved": "2026-05-08T16:23:33.263Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T14:42:00.807Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "guarddog", "vendor": "DataDog", "versions": [{"status": "affected", "version": ">= 2.6.0, <= 2.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs."}, {"lang": "es", "value": "GuardDog es una herramienta de CLI para identificar paquetes de PyPI maliciosos. Desde 2.6.0 hasta 2.9.0, GuardDog incluye nombres de archivo, ubicaciones de archivo, mensajes y fragmentos de c\u00f3digo controlados por el atacante en su salida predeterminada legible para humanos sin escapar los caracteres de control de terminal. Un paquete malicioso puede, por lo tanto, inyectar secuencias de escape ANSI u OSC en terminales de analistas o registros de CI."}], "id": "CVE-2026-44972", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44972", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T15:34:24.334334Z", "version": "2.0.3"}}]}, "published": "2026-05-27T15:16:29.690", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.0,2.9.0]"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "guarddog", "source": "cna", "vendor": "DataDog"}, "product": "guarddog", "vendor": "datadoghq"}], "created": "2026-05-27T21:15:25.920998+00:00", "updated": "2026-05-30T21:00:12.259856+00:00", "vendors": ["datadoghq", "datadoghq$PRODUCT$guarddog"]}