CVE-2026-22871

Critical

Published: 13/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

GuardDog, a CLI tool to identify malicious PyPI packages, prior to version 2.7.1 has a path traversal vulnerability in its safe_extract() function. Malicious PyPI packages can write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This is fixed in 2.7.1.

Risk Assessment

The vulnerability could allow an attacker to overwrite critical system files or execute malicious code, threatening system integrity and data security.

Recommendation

Update GuardDog to version 2.7.1 or later, which includes the fix. Avoid running GuardDog on untrusted packages without updating.

Original NVD description (English source)

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.