PT-2026-39678 · Datadog+1 · Guarddog

Bg0D-Glitch · Published 2026-05-11 · Updated 2026-05-27 · CVE-2026-44972

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GuardDog versions 2.6.0 through 2.9.0

Description GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. This allows a malicious package to inject ANSI or OSC escape sequences into analyst terminals or CI logs. The issue occurs because the human-readable reporter prints values directly from the finding formatter without applying escaping for control characters such as x1b. This can be exploited to clear or rewrite terminal output, inject spoofed log content in CI, or emit clickable OSC 8 hyperlinks and title changes in compatible terminals.

Recommendations For versions 2.6.0 through 2.9.0, escape or strip terminal control characters before rendering package names, file paths, messages, and code snippets in human-readable output.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-44972

GHSA-M5P4-GVPX-4MVR

Affected Products

Guarddog

References · 4

• https://osv.dev/vulnerability/GHSA-m5p4-gvpx-4mvr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44972 · Security Note
• https://github.com/DataDog/guarddog/security/advisories/GHSA-m5p4-gvpx-4mvr · Note
• https://github.com/DataDog/guarddog · Note