GHSA-M5P4-GVPX-4MVR

Vulnerability from github – Published: 2026-05-11 14:43 – Updated: 2026-06-08 23:42
VLAI
Summary
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
Details

Summary

GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs.

Description

The finding formatter stores file paths and snippets from scanned content:

location = file_path + ":" + str(start_line)
finding = {
    "location": location,
    "code": code,
    "message": result["extra"]["message"],
}

The human-readable reporter later prints these values directly:

"  * " + finding["message"] + " at " + finding["location"] + "\n    " + _format_code_line_for_output(finding["code"])

No escaping is applied for control characters such as \x1b. A malicious package can therefore ship a filename like:

evil\x1b[2J.py

or matched source lines containing terminal escapes, which survive into the final CLI output.

Reproduction summary

  1. Create a file whose name contains \x1b[2J.
  2. Feed a semgrep-style result referencing that file into Analyzer._format_semgrep_response().
  3. Render the result with HumanReadableReporter.print_scan_results().
  4. The output string contains the raw escape bytes, which a terminal may interpret.

Key code paths

  • guarddog/analyzer/analyzer.py:377-392
  • guarddog/reporters/human_readable.py:36-42
  • guarddog/reporters/human_readable.py:84-91

Practical impact

This can be used to: - clear or rewrite analyst terminal output - inject misleading or spoofed log content in CI - emit clickable OSC 8 hyperlinks or title changes in compatible terminals

Prior public disclosure check

As of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.

Suggested fix

Escape or strip terminal control characters before rendering any attacker-controlled value in human-readable output. This should cover package names, file paths, messages, and code snippets.

Severity
5.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "guarddog"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "last_affected": "2.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T14:43:43Z",
    "nvd_published_at": "2026-05-27T15:16:29Z",
    "severity": "MODERATE"
  },
  "details": "# Summary\nGuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs.\n\n# Description\nThe finding formatter stores file paths and snippets from scanned content:\n\n```python\nlocation = file_path + \":\" + str(start_line)\nfinding = {\n    \"location\": location,\n    \"code\": code,\n    \"message\": result[\"extra\"][\"message\"],\n}\n```\n\nThe human-readable reporter later prints these values directly:\n\n```python\n\"  * \" + finding[\"message\"] + \" at \" + finding[\"location\"] + \"\\n    \" + _format_code_line_for_output(finding[\"code\"])\n```\n\nNo escaping is applied for control characters such as `\\x1b`. A malicious package can therefore ship a filename like:\n\n```text\nevil\\x1b[2J.py\n```\n\nor matched source lines containing terminal escapes, which survive into the final CLI output.\n\n# Reproduction summary\n1. Create a file whose name contains `\\x1b[2J`.\n2. Feed a semgrep-style result referencing that file into `Analyzer._format_semgrep_response()`.\n3. Render the result with `HumanReadableReporter.print_scan_results()`.\n4. The output string contains the raw escape bytes, which a terminal may interpret.\n\n# Key code paths\n- `guarddog/analyzer/analyzer.py:377-392`\n- `guarddog/reporters/human_readable.py:36-42`\n- `guarddog/reporters/human_readable.py:84-91`\n\n# Practical impact\nThis can be used to:\n- clear or rewrite analyst terminal output\n- inject misleading or spoofed log content in CI\n- emit clickable OSC 8 hyperlinks or title changes in compatible terminals\n\n# Prior public disclosure check\nAs of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.\n\n# Suggested fix\nEscape or strip terminal control characters before rendering any attacker-controlled value in human-readable output. This should cover package names, file paths, messages, and code snippets.",
  "id": "GHSA-m5p4-gvpx-4mvr",
  "modified": "2026-06-08T23:42:18Z",
  "published": "2026-05-11T14:43:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44972"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DataDog/guarddog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.