CVE-2026-44220: Jo-Jo98 ciguard symlink following in discover_pipeline_files

CVE-2026-44220 · Severity: low · CVSS 3.2 · Published 2026-05-12

ciguard is a tool used to scan software repositories for pipeline configuration files. A vulnerability allows a malicious repository to use symbolic links to trick the scanner into reading sensitive files from the user's computer, such as AWS credentials or system configurations, that are outside the intended scan folder. This could lead to the theft of secrets or internal network information if a user or AI agent is tricked into scanning a malicious directory.

Technologies: ciguard (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44220 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44220 being exploited in the wild.
How severe is CVE-2026-44220?
Low severity, with a CVSS score of 3.2, published 12 May 2026.
Which products and versions are affected?
ciguard (PyPI) >= 0.8.0, <= 0.8.1, ECOSYSTEM:introduced=0.8.0,fixed=0.8.2.
Is there a fix for CVE-2026-44220?
Yes. ciguard (PyPI): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44220 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-44220?
Check whether you run ciguard (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ciguard (PyPI): upgrade to 0.8.2 or later
    pip install "ciguard>=0.8.2"

Technical details

The `discover_pipeline_files()` function in `src/ciguard/discovery.py` (introduced in v0.8.0) walks directory trees and follows symbolic links without verifying if the resolved path remains within the intended root directory. An attacker can exploit this by placing a malicious symlink in a repository; when a user or AI agent (via the MCP server) scans that directory, the tool will follow the link to arbitrary locations on the filesystem (e.g., `~/.aws/` or `/etc/`). This is a 'confused deputy' attack that can result in the disclosure of sensitive pipeline-shaped files containing secrets or internal hostnames. The issue is fixed in version 0.8.2 by disabling symlink following by default and implementing a 'belt-and-braces' check to ensure resolved paths are children of the scan root.

Affected products

  • Jo-Jo98 ciguard >= 0.8.0, <= 0.8.1

Identifiers

  • CVE-2026-44220
  • GHSA-8cxw-cc62-q28v
  • PYSEC-2026-2408

Timeline

  • 2026-04-26: disclosed: Found during internal penetration test.
  • 2026-04-26: patched: Fix released in v0.8.2.
  • 2026-05-05: advisory: GitHub Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.