High severity · published Dec 17, 2022
CVE-2022-23531
GuardDog is a CLI tool to identify malicious PyPI packages
7.8
CVSS
0.7%
EPSS
No
On KEV
Description
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GU
Guarddog · Datadoghq
before 0.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23531
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23531
Patch
https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306
Release Notes
https://github.com/DataDog/guarddog/releases/tag/v0.1.5
Third Party Advisory
https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vq
More from Guarddog
9.8
CVE-2026-22871
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
7.5
CVE-2026-22870
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
6.5
CVE-2022-23530
GuardDog is a CLI tool to identify malicious PyPI packages