CVE-2022-23531

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

• CWE-23
• CWE-22

• https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306Patch, Third Party Advisory
• https://github.com/DataDog/guarddog/releases/tag/v0.1.5Release Notes, Third Party Advisory
• https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vqThird Party Advisory
• https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306Patch, Third Party Advisory
• https://github.com/DataDog/guarddog/releases/tag/v0.1.5Release Notes, Third Party Advisory
• https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vqThird Party Advisory

Published

Dec 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23525Helm is a tool for managing Charts, pre-configured Kubernete…7.5
• CVE-2022-23526Helm is a tool for managing Charts, pre-configured Kubernete…7.5
• CVE-2022-23527mod_auth_openidc is an OpenID Certified™ authentication and …6.1
• CVE-2022-23529Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-2353Prior to microweber/microweber v1.2.20, due to improper neut…6.1
• CVE-2022-23530GuardDog is a CLI tool to identify malicious PyPI packages. …6.5
• CVE-2022-23532APOC (Awesome Procedures on Cypher) is an add-on library for…6.5
• CVE-2022-23535LiteDB is a small, fast and lightweight .NET NoSQL embedded …9.8
• CVE-2022-23536Cortex provides multi-tenant, long term storage for Promethe…6.5
• CVE-2022-23537PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23538github.com/sylabs/scs-library-client is the Go client for th…7.6
• CVE-2022-23539Versions `<=8.5.1` of `jsonwebtoken` library could be miscon…8.1