GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repo…

GuardDog CLI tool for identifying malicious PyPI packages contains a Server-Side Request Forgery (SSRF) vulnerability in versions 1.0.0 to 2.9.0. The vulnerability occurs in the programmatic remote project scanning path where attacker-controlled repository URLs are processed using blind string replacement. This allows attackers to manipulate repository URLs and capture GitHub credentials (GH_TOKEN) sent with the resulting requests. The vulnerability enables credential theft through SSRF attacks when scanning remote projects.