CVE-2022-23531

CVE-2022-23531 is a relative path traversal vulnerability affecting GuardDog, a CLI tool for identifying malicious PyPI packages, in versions prior to 0.1.5. An attacker can craft a malicious local PyPI package that, when scanned by GuardDog, allows arbitrary file writing on the executing machine due to a flaw in the tarfile.TarFile.extractall function. This vulnerability has a CVSS score of 7.8 (High), indicating a local attack vector with low complexity, requiring user interaction, and leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.