CVE-2026-44972

{
  "id": "CVE-2026-44972",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T15:16:29.690",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs."
    },
    {
      "lang": "es",
      "value": "GuardDog es una herramienta de CLI para identificar paquetes de PyPI maliciosos. Desde 2.6.0 hasta 2.9.0, GuardDog incluye nombres de archivo, ubicaciones de archivo, mensajes y fragmentos de código controlados por el atacante en su salida predeterminada legible para humanos sin escapar los caracteres de control de terminal. Un paquete malicioso puede, por lo tanto, inyectar secuencias de escape ANSI u OSC en terminales de analistas o registros de CI."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "DataDog",
          "product": "guarddog",
          "versions": [
            {
              "version": ">= 2.6.0, <= 2.9.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T15:34:24.334334Z",
          "id": "CVE-2026-44972",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr",
      "source": "[email protected]"
    }
  ]
}