CVE-2026-22871

CVE-2026-22871 describes a critical path traversal vulnerability in GuardDog, a CLI tool for identifying malicious PyPI packages, affecting versions prior to 2.7.1. This flaw allows malicious packages to write arbitrary files outside their intended directory, potentially leading to arbitrary file overwrite and remote code execution on systems running GuardDog. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, posing a severe risk to confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion, indicating awareness. Organizations using GuardDog should immediately upgrade to version 2.7.1 or later to mitigate this significant risk.