Is CVE-2026-44972 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44972 being exploited in the wild.

How severe is CVE-2026-44972?

Medium severity, with a CVSS score of 5, published 27 May 2026.

Which products and versions are affected?

guarddog (PyPI) >= 2.6.0, <= 2.9.0, ECOSYSTEM:introduced=2.6.0,last_affected=2.9.0.

Is there a fix for CVE-2026-44972?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44972 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-44972?

Check whether you run guarddog (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44972: DataDog GuardDog terminal escape injection in scan output

Q: Is there a fix for CVE-2026-44972?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44972 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-44972?

Check whether you run guarddog (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44972 · Severity: medium · CVSS 5 · Published 2026-05-27

GuardDog is a tool used to scan Python packages for malicious content. A vulnerability in its reporting component allows a malicious package to include special hidden characters in its filenames or code. When a security analyst scans such a package, these characters can manipulate the analyst's terminal screen, potentially clearing logs, spoofing scan results, or creating misleading clickable links.

Technologies: guarddog (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44972 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44972 being exploited in the wild.
How severe is CVE-2026-44972?: Medium severity, with a CVSS score of 5, published 27 May 2026.
Which products and versions are affected?: guarddog (PyPI) >= 2.6.0, <= 2.9.0, ECOSYSTEM:introduced=2.6.0,last_affected=2.9.0.
Is there a fix for CVE-2026-44972?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44972 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-44972?: Check whether you run guarddog (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GuardDog's HumanReadableReporter fails to sanitize or escape ANSI and OSC terminal control sequences (such as \x1b) found in attacker-controlled data. This data includes package filenames, file paths, and source code snippets extracted during the scan process. An attacker can craft a malicious package with filenames or code containing these sequences. When the CLI tool renders the scan results, the terminal interprets these raw bytes, enabling an attacker to clear terminal output, spoof log entries, or emit OSC 8 hyperlinks. The vulnerability exists in guarddog/analyzer/analyzer.py and guarddog/reporters/human_readable.py.

Affected products

DataDog guarddog >= 2.6.0, <= 2.9.0

Identifiers

CVE-2026-44972
GHSA-m5p4-gvpx-4mvr
PYSEC-2026-2506

Timeline

2026-05-11: advisory: GitHub Advisory published
2026-05-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.