CVE-2026-44972 Details

A vulnerability exists in GuardDog, a command-line interface tool for identifying malicious PyPI packages, versions 2.6.0 through 2.9.0. The issue arises because the tool's default human-readable output includes filenames, file locations, messages, and code snippets controlled by attackers, without properly escaping terminal control characters. This oversight allows malicious packages to inject ANSI or OSC escape sequences into the terminals of analysts or into continuous integration logs.

Users are advised to escape or remove terminal control characters from any attacker-controlled content before it is displayed in human-readable formats. This should include package names, file paths, messages, and code snippets.