CVE-2022-23530 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

What is CVE-2022-23530?

CVE-2022-23530 is a medium-severity path traversal vulnerability in DataDog guarddog, published on 16 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.

Weakness: CWE-22

Which versions are affected by CVE-2022-23530?

3 open source packages ship an affected version, including guarddog. It affects 1 product.

Products include Datadoghq Guarddog.

How do I fix CVE-2022-23530?

Upgrade guarddog to 0.1.8 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-23530 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23530 exists.

Other vulnerabilities in DataDog guarddog

• CVE-2026-22871 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE High 8.7
• CVE-2026-22870 GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS High 7.1
• CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-78m5-jpmf-ch7v, PYSEC-2022-42993.