GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package

HIGH 7.8CVE-2022-23531 · GHSA-rp2v-v467-q9vq · PYSEC-2022-42994 · Published 17/12/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
guarddog PyPI	`< 0.1.5`	`0.1.5`
guarddog datadoghq	`< 0.1.5`	`0.1.5`

Description

Impact

Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed.

This is due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

Remediation

Upgrade to GuardDog v0.1.5 or more recent.

References

NVD description

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

References

DataDog/guarddog security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-23531 · ADVISORY
DataDog/guarddog#89 · WEB
DataDog/guarddog commit 98af5c8 · WEB
DataDog/guarddog · PACKAGE
DataDog/guarddog release v0.1.5 · WEB
pypa/advisory-database · WEB
DataDog/guarddog#89 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free