https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:08:15.354529+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-23530 CVE-2022-23530 — GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package 2026-10-03T06:08:15.385531+00:00

Affected: DataDog guarddog

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.

 https://cve.radiocsirt.org/vuln/ghsa-78m5-jpmf-ch7v GHSA-78m5-jpmf-ch7v — GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package 2026-10-03T06:08:15.385590+00:00

Affected: PyPI: guarddog

### Summary

Unsafe extracting using `shutil.unpack_archive()` from a remotely retrieved tarball may lead to writing the extracted file to an unintended destination.

### Details

Extracting files using `shutil.unpack_archive()` from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten.

The vulnerable code snippet is between [L153..158](https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158).

```python response = requests.get(url, stream=True)

with open(zippath, "wb") as f: f.write(response.raw.read())

shutil.unpack_archive(zippath, unzippedpath) ``` It seems that a remotely retrieved tarball which could be with the extension `.tar.gz` happens to be unpacked using `shutil.unpack_archive()` with no destination verification/limitation of the extracted files.

### PoC

The PoC provided showcases the risk of extracting the non-harmless text file `sim4n6.txt` to a parent location rather than the current folder.

```bash > tar --list -f archive.tar tar: Removing leading `../../../' from member names ../../../sim4n6.txt

> python3 Python 3.10.6 (main, Nov 2 2022, 18:53:38) [GCC 11.3.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import shutil >>> shutil.unpack_archive("archive.tar") >>> exit()

> file ../../../sim4…