CVE-2022-23530

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.

• CWE-22

• https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158Exploit, Third Party Advisory
• https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491cPatch, Third Party Advisory
• https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7vExploit, Third Party Advisory
• https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158Exploit, Third Party Advisory
• https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491cPatch, Third Party Advisory
• https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7vExploit, Third Party Advisory

Published

Dec 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23524Helm is a tool for managing Charts, pre-configured Kubernete…7.5
• CVE-2022-23525Helm is a tool for managing Charts, pre-configured Kubernete…7.5
• CVE-2022-23526Helm is a tool for managing Charts, pre-configured Kubernete…7.5
• CVE-2022-23527mod_auth_openidc is an OpenID Certified™ authentication and …6.1
• CVE-2022-23529Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-2353Prior to microweber/microweber v1.2.20, due to improper neut…6.1
• CVE-2022-23531GuardDog is a CLI tool to identify malicious PyPI packages. …7.8
• CVE-2022-23532APOC (Awesome Procedures on Cypher) is an add-on library for…6.5
• CVE-2022-23535LiteDB is a small, fast and lightweight .NET NoSQL embedded …9.8
• CVE-2022-23536Cortex provides multi-tenant, long term storage for Promethe…6.5
• CVE-2022-23537PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23538github.com/sylabs/scs-library-client is the Go client for th…7.6