Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2026-44972

GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DataDog guarddog

  • >= 2.6.0, <= 2.9.0affected

References