TI-2026-32199 Aliases CVE-2026-44220 GHSA-8cxw-cc62-q28v

ciguard: discover_pipeline_files follows symlinks out of scan root

MEDIUM 49CWE-59Published 2026-05-12 · Updated 2026-05-13

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-59 and the CVSS impact.

Summary

ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discover_pipeline_files() function in src/ciguard/discovery.py walks a directory tree following symlinks, with cycle protection via tracking visited resolved paths. An attacker who can plant a symlink in a directory the user (or AI agent) scans can cause discovery to walk into the symlink target and return paths to pipeline-shaped files outside the requested root. This vulnerability is fixed in 0.8.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00214 11th percentileScored 2026-11-07

Fix Fixed ciguard (Jo-Jo98): 0.8.2ciguard (PyPI): 0.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jo-Jo98	ciguard	0.8.0 to before 0.8.2	0.8.2	Patch available	CNA
—	ciguard (PyPI)	0.8.0 to before 0.8.2	0.8.2	Patch available	GHSA-8cxw-cc62-q28v

ciguard VendorJo-Jo98 Affected 0.8.0 to before 0.8.2 Fixed in 0.8.2 Patch available CNA
ciguard (PyPI) Vendor— Affected 0.8.0 to before 0.8.2 Fixed in 0.8.2 Patch available GHSA-8cxw-cc62-q28v

Remediation

Fix · CNA ciguard (Jo-Jo98) Fixed in 0.8.2
Fix · GHSA-8cxw-cc62-q28v ciguard (PyPI) Fixed in 0.8.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44220
2026-10-03 Alias added: GHSA-8cxw-cc62-q28v

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44220

Other 4

TI-2026-32198 ciguard: SCA HTTP client reads response body without size cap CVSS 3.1LOW 3.7
TI-2026-32197 ciguard: Container image runs as root (no USER directive) CVSS 3.1LOW 3.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences