GuardDog is a CLI utility used to scan PyPI packages for malicious content. A vulnerability in the safe_extract() function allows an attacker to craft a malicious package that, when processed by GuardDog, writes files outside the intended extraction directory. This leads to arbitrary file overwrite, which can compromise system files or execute arbitrary code, resulting in full system takeover on machines running GuardDog.

The affected product is DataDog GuardDog, a Python-based CLI tool. All releases prior to version 2.7.1 are vulnerable; users must ensure they are not running any older revision.

The CVSS score is 8.7, indicating high severity, while the EPSS score is less than 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be a local user or process that supplies a malicious PyPI package to GuardDog, which then extracts files beyond the intended directory, leading to overwrite and execution of malicious code.