CVE-2026-44972: DataDog GuardDog terminal escape injection in scan output

Executive brief

GuardDog is a tool used to scan Python packages for malicious content. A vulnerability in its reporting component allows a malicious package to include special hidden characters in its filenames or code. When a security analyst scans such a package, these characters can manipulate the analyst's terminal screen, potentially clearing logs, spoofing scan results, or creating misleading clickable links.

Technical details

GuardDog's HumanReadableReporter fails to sanitize or escape ANSI and OSC terminal control sequences (such as \x1b) found in attacker-controlled data. This data includes package filenames, file paths, and source code snippets extracted during the scan process. An attacker can craft a malicious package with filenames or code containing these sequences. When the CLI tool renders the scan results, the terminal interprets these raw bytes, enabling an attacker to clear terminal output, spoof log entries, or emit OSC 8 hyperlinks. The vulnerability exists in guarddog/analyzer/analyzer.py and guarddog/reporters/human_readable.py.

Affected products

• DataDog guarddog >= 2.6.0, <= 2.9.0

Timeline

• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-27: disclosed: NVD publication date

References

• https://api.github.com/users/bg0d-glitch
• https://github.com/bg0d-glitch
• https://api.github.com/users/bg0d-glitch/gists%7B/gist_id%7D
• https://api.github.com/users/bg0d-glitch/repos
• https://avatars.githubusercontent.com/u/147250644?v=4
• https://api.github.com/users/bg0d-glitch/events%7B/privacy%7D