GuardDog, a CLI tool that identifies malicious PyPI packages, includes attacker‑controlled filenames, file locations, messages, and code snippets in its default human‑readable output between versions 2.6.0 and 2.9.0 without escaping terminal control characters. This lack of sanitization allows a malicious package to inject ANSI or OSC escape sequences that are interpreted by analyst terminals or CI logs, potentially altering the visual output or tampering with log contents.

DataDog GuardDog versions 2.6.0 through 2.9.0 are affected. Any system running these releases and displaying GuardDog’s output in a terminal or CI environment that processes ANSI/OSC escape codes is at risk. The tool is typically used by security analysts and continuous‑integration pipelines to scan Python packages.

The CVSS score of 5.0 indicates moderate severity. Exploitation requires a malicious package to be supplied for scanning, which is realistic in supply‑chain attack scenarios. EPSS is not available, and the vulnerability is not yet listed in CISA KEV, suggesting no widespread exploitation. The attack vector is primarily local or controlled by the analyst running GuardDog, as it relies on displaying unescaped output.