Command Line Tool Vulnerability in GuardDog by DataDog
CVE-2026-44972

5MEDIUM

Key Information:

Vendor

Datadog

Status
Guarddog
Vendor
CVE Published:
27 May 2026

What is CVE-2026-44972?

GuardDog, a command line interface tool developed by DataDog for identifying malicious PyPI packages, has a vulnerability in versions 2.6.0 to 2.9.0. This flaw allows for the inclusion of attacker-controlled filenames, file paths, messages, and code snippets within its default output. The application fails to escape terminal control characters, leaving analyst terminals and CI logs susceptible to the injection of ANSI and OSC escape sequences from malicious package outputs. This can lead to undesired effects in the presentation of command-line outputs, potentially obfuscating malicious actions or leading to information leakage.

Affected Version(s)

guarddog >= 2.6.0, <= 2.9.0

References

https://github.com/DataDog/guarddog/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.