-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| guarddog | pip | < 0.1.5 | 0.1.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems directly from using Python's built-in tarfile.TarFile.extractall function, which is known to have insecure path handling by design. The commit diff shows the vulnerable code was 'tarfile.open(path).extractall(tmpdirname)' in package_scanner.py. The patch replaced it with tarsafe.open().extractall(), which specifically addresses path traversal. The CWE-22/CWE-23 mapping and advisory references confirm this is a path traversal vulnerability caused by insecure archive extraction.