CVE-2026-22870
HighSummary
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data.
Risk Assessment
The risk is the potential exhaustion of disk resources on the system where GuardDog is run, which could lead to service disruption or system failure.
Recommendation
It is recommended to immediately upgrade GuardDog to version 2.7.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in GuardDog
Original NVD description (English source)
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.