PyPIPackage

guarddog

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 3.2.0 (Aug 12, 2026): no advisory affects it
Newest unaffected release: 3.2.0 (Aug 12, 2026), the latest release
Advisories: 6 · 3 high, 3 medium

Weekly downloads: 28.4K
Dependents: 3
Releases: 66 since 0.1.1 (Nov 28, 2022)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-44971
Affects 1.0.0 to 2.9.0 (2.10.0 is outside it)
CVE-2026-44972
Affects 2.6.0 to 2.9.0 (2.10.0 is outside it)
CVE-2026-22871
Affects 0.1.1 to 2.7.0 (2.7.1 is outside it)
CVE-2026-22870
Affects 0.1.1 to 2.7.0 (2.7.1 is outside it)
CVE-2022-23531
Affects 0.1.1 to 0.1.4 (0.1.5 is outside it)
CVE-2022-23530
Affects 0.1.1 to 0.1.7 (0.1.8 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-44971High 8.2
GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Affected: from 1.0.0, through 2.9.0.
Fixed in 2.10.0 (released May 7, 2026, 20 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.2.0, is not affected.
CVE-2026-44972Medium 5.0
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
Affected: from 2.6.0, through 2.9.0.
Fixed in 2.10.0 (released May 7, 2026, 20 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.2.0, is not affected.
CVE-2026-22871High 8.7
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
Affected: fixed in 2.7.1.
Fixed in 2.7.1 (released Jan 9, 2026, 4 days before disclosure).
The latest release, 3.2.0, is not affected.
CVE-2026-22870High 7.1
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
Affected: fixed in 2.7.1.
Fixed in 2.7.1 (released Jan 9, 2026, 4 days before disclosure).
The latest release, 3.2.0, is not affected.
CVE-2022-23531Medium 5.8
Arbitrary file write when scanning a specially-crafted local PyPI package
Affected: fixed in 0.1.5.
Fixed in 0.1.5 (released Nov 29, 2022, 17 days before disclosure).
The latest release, 3.2.0, is not affected.
CVE-2022-23530Medium 5.8
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
Affected: fixed in 0.1.8.
Fixed in 0.1.8 (released Dec 5, 2022, 11 days before disclosure).
The latest release, 3.2.0, is not affected.