PyPI/guarddog CVE-2026-44971: high 8.2, EPSS 0.34%
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | - | 2.9.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-587r-mc96-6f2p
- https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p
- https://nvd.nist.gov/vuln/detail/CVE-2026-44971
- https://github.com/DataDog/guarddog
CVE-2026-44971 · published · modified · JSON