Security Advisory

CVE-2022-23531

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2022-12-16 23:41:15

Last updated 2025-04-17 14:33:54

Assigner GitHub_M

State PUBLISHED

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

← Browse all CVEs View on cve.org ↗