PYSEC-2022-42994

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/guarddog/PYSEC-2022-42994.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2022-42994
Aliases
Published
2022-12-17T00:15:00Z
Modified
2026-02-20T06:26:12.056324Z
Summary
[none]
Details

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

References

Affected packages

PyPI / guarddog

Package

Name
guarddog
View open source insights on deps.dev
Purl
pkg:pypi/guarddog

Affected ranges

Type
GIT
Repo
https://github.com/DataDog/guarddog
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a56aff58264cb6b7855d71b00dc10c39a5dbd306
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.5

Affected versions

0.*
0.1.1
0.1.3
0.1.4

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/guarddog/PYSEC-2022-42994.yaml"