CVE-2022-23531

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
DataDog	guarddog	< 0.1.5

References

https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306Patch, Third Party Advisory
https://github.com/DataDog/guarddog/releases/tag/v0.1.5Release Notes, Third Party Advisory
https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vqThird Party Advisory
https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306Patch, Third Party Advisory
https://github.com/DataDog/guarddog/releases/tag/v0.1.5Release Notes, Third Party Advisory
https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vqThird Party Advisory

Timeline

Published: Dec 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-235326.5APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vuln CVE-2022-235359.8LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted D CVE-2022-235366.5Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.CVE-2022-235379.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-235387.6github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-l CVE-2022-235398.1Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. CVE-2022-23547.2The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite i CVE-2022-235407.6In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validatio CVE-2022-235416.3jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a p CVE-2022-235429.8OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, CVE-2022-235435.4Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate rel CVE-2022-235446.1MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance t