Vulnerability-Lookup

PYSEC-2026-206

Vulnerability from pysec - Published: 2026-06-05 20:17 - Updated: 2026-06-09 10:40

Details

Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai (0.10.1) to PyPI. Aany user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Impacted products

Name	purl
guardrails-ai	pkg:pypi/guardrails-ai

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "guardrails-ai",
        "purl": "pkg:pypi/guardrails-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.0rc1",
        "0.1.0rc2",
        "0.1.0rc3",
        "0.1.1",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "0.10.0",
        "0.10.0a0",
        "0.10.0a1",
        "0.10.0a2",
        "0.10.0a3",
        "0.10.0a4",
        "0.10.0a5",
        "0.2.0",
        "0.2.0a1",
        "0.2.0a2",
        "0.2.0a3",
        "0.2.0a4",
        "0.2.0a5",
        "0.2.0a6",
        "0.2.1",
        "0.2.1a0",
        "0.2.2",
        "0.2.3",
        "0.2.3a1",
        "0.2.4",
        "0.2.4a1",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.2.8",
        "0.2.9",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.3.3",
        "0.4.0",
        "0.4.1",
        "0.4.2",
        "0.4.3",
        "0.4.4",
        "0.4.5",
        "0.5.0",
        "0.5.0a0",
        "0.5.0a1",
        "0.5.0a10",
        "0.5.0a11",
        "0.5.0a12",
        "0.5.0a13",
        "0.5.0a2",
        "0.5.0a3",
        "0.5.0a4",
        "0.5.0a5",
        "0.5.0a6",
        "0.5.0a7",
        "0.5.0a8",
        "0.5.0a9",
        "0.5.1",
        "0.5.10",
        "0.5.11",
        "0.5.12",
        "0.5.13",
        "0.5.14",
        "0.5.15",
        "0.5.2",
        "0.5.3",
        "0.5.4",
        "0.5.5",
        "0.5.6",
        "0.5.7",
        "0.5.8",
        "0.5.9",
        "0.6.0",
        "0.6.0a1",
        "0.6.0a2",
        "0.6.0a3",
        "0.6.0a4",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.6.5",
        "0.6.6",
        "0.6.7",
        "0.6.8",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.9.0",
        "0.9.0rc0",
        "0.9.1",
        "0.9.2",
        "0.9.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45758",
    "GHSA-xmpw-2vmm-p4p6"
  ],
  "details": "Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. Aany user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.",
  "id": "PYSEC-2026-206",
  "modified": "2026-06-09T10:40:25.273181Z",
  "published": "2026-06-05T20:17:32.357Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/guardrails-ai/guardrails/security/advisories/GHSA-xmpw-2vmm-p4p6"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/guardrails-ai/guardrails/issues/1473"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-45758 (GCVE-0-2026-45758)

Vulnerability from cvelistv5 – Published: 2026-06-05 19:35 – Updated: 2026-06-08 16:21

Title

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Summary

Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. Aany user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-506 - Embedded Malicious Code

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/guardrails-ai/guardrails/secur…	x_refsource_CONFIRM
https://github.com/guardrails-ai/guardrails/issues/1473	x_refsource_MISC
https://github.com/guardrails-ai/guardrails/blob/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
guardrails-ai	guardrails	Affected: = 0.10.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T16:20:02.293656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:21:05.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "guardrails",
          "vendor": "guardrails-ai",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.10.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. Aany user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T19:35:45.801Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/guardrails-ai/guardrails/security/advisories/GHSA-xmpw-2vmm-p4p6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/guardrails-ai/guardrails/security/advisories/GHSA-xmpw-2vmm-p4p6"
        },
        {
          "name": "https://github.com/guardrails-ai/guardrails/issues/1473",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/guardrails-ai/guardrails/issues/1473"
        },
        {
          "name": "https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md"
        }
      ],
      "source": {
        "advisory": "GHSA-xmpw-2vmm-p4p6",
        "discovery": "UNKNOWN"
      },
      "title": "Malicious code in guardrails-ai 0.10.1 (supply chain compromise)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45758",
    "datePublished": "2026-06-05T19:35:45.801Z",
    "dateReserved": "2026-05-13T06:54:34.222Z",
    "dateUpdated": "2026-06-08T16:21:05.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-XMPW-2VMM-P4P6

Vulnerability from github – Published: 2026-05-19 15:40 – Updated: 2026-06-09 13:13

Summary

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Details

Impact

On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai (0.10.1) to PyPI.

Affected: any user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026.

Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, we have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through our systems.

For the full timeline, technical details, and remediation steps we have taken, see SECURITY_ADVISORY.md.

Patches

No patched version above 0.10.1 is available yet. Downgrade to 0.10.0, which is unaffected.

Workarounds

1. Pin to a safe version:

guardrails-ai==0.10.0

2. While the PyPI quarantine is active, install from GitHub:

pip install git+https://github.com/guardrails-ai/guardrails.git@v0.10.0

The v0.10.0 tag in this repository is clean. Track quarantine status here: #1473.

3. If you installed 0.10.1, treat the host as potentially compromised. Rotate any credentials accessible from that machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit your GitHub account for unauthorized workflows or repositories.

4. Snowglobe and Guardrails Hub users : all Snowglobe and Guardrails Hub API keys will be invalidated at 2:00 PM Pacific on May 13, 2026. Rotate yours before then to avoid service interruption.

References

Full advisory, timeline, and remediation details: SECURITY_ADVISORY.md

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "guardrails-ai"
      },
      "versions": [
        "0.10.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T15:40:44Z",
    "nvd_published_at": "2026-06-05T20:17:32Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nOn May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI.\n\n**Affected:** any user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026.\n\nSecurity researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, we have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through our systems.\n\nFor the full timeline, technical details, and remediation steps we have taken, see [SECURITY_ADVISORY.md](https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md).\n\n### Patches\n\nNo patched version above 0.10.1 is available yet. **Downgrade to `0.10.0`**, which is unaffected.\n\n### Workarounds\n\n**1. Pin to a safe version:**\n\n`guardrails-ai==0.10.0`\n\n**2. While the PyPI quarantine is active, install from GitHub:**\n\n`pip install git+https://github.com/guardrails-ai/guardrails.git@v0.10.0`\n\nThe `v0.10.0` tag in this repository is clean. Track quarantine status here: [#1473](https://github.com/guardrails-ai/guardrails/issues/1473).\n\n**3. If you installed 0.10.1, treat the host as potentially compromised.** Rotate any credentials accessible from that machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit your GitHub account for unauthorized workflows or repositories.\n\n**4. Snowglobe and Guardrails Hub users :** all Snowglobe and Guardrails Hub API keys will be invalidated at 2:00 PM Pacific on May 13, 2026. Rotate yours before then to avoid service interruption.\n\n### References\n\n- Full advisory, timeline, and remediation details: [SECURITY_ADVISORY.md](https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md)",
  "id": "GHSA-xmpw-2vmm-p4p6",
  "modified": "2026-06-09T13:13:18Z",
  "published": "2026-05-19T15:40:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/guardrails-ai/guardrails/security/advisories/GHSA-xmpw-2vmm-p4p6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45758"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guardrails-ai/guardrails/issues/1473"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/guardrails-ai/guardrails"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/guardrails-ai/PYSEC-2026-206.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Malicious code in guardrails-ai 0.10.1 (supply chain compromise)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2026-206

CVE-2026-45758 (GCVE-0-2026-45758)

GHSA-XMPW-2VMM-P4P6

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature