Server-Side Request Forgery in GuardDog CLI Tool from DataDog

CVE-2026-44971

What is CVE-2026-44971?

GuardDog, a CLI tool developed by DataDog to detect malicious PyPI packages, suffers from a vulnerability that affects versions 1.0.0 to 2.9.0. The flaw arises from its programmatic remote project scanning path, which allows attacker-controlled repository URLs to be rewritten via a blind string replacement mechanism. This leads to potential SSRF attacks, where an attacker can influence the scanned repository URL to craft requests that could expose sensitive credentials, such as GitHub tokens (GH_TOKEN). This vulnerability illustrates the risks associated with insufficient URL validation and the secure management of credentials during external requests.

References