EUVD-2026-29556
GHSA-r6hf-g5x6-7pv9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post_install field. The script path is constructed from untrusted manifest data and executed without proper validation or sanitization, allowing remote code execution. An attacker who can publish malicious packages to the Hub can inject arbitrary code that will be executed on any system where a victim installs the malicious package.
AnalysisAI
Remote code execution in Guardrails AI through version 0.6.7 occurs when installing validator packages via the Hub mechanism. The guardrails hub install command dynamically executes post-installation scripts from Hub manifests without validating the script path or content, allowing attackers who publish malicious packages to achieve arbitrary code execution on victim systems during package installation. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) but only 0.06% EPSS (18th percentile), this represents a supply chain attack requiring user-initiated installation rather than widespread automated exploitation. No active exploitation confirmed (not in CISA KEV), and patch availability not confirmed from available data.
Technical ContextAI
Guardrails AI is an ML validation framework with a package ecosystem hosted on Guardrails Hub. The vulnerability stems from CWE-94 (Improper Control of Generation of Code, aka code injection) in the Hub client's package installation workflow. When executing guardrails hub install, the client retrieves a JSON manifest from the remote Hub repository containing metadata including a post_install field specifying a script path. The client constructs the full script path by concatenating untrusted manifest data with local filesystem paths, then executes this script without input validation, path traversal checks, or sandboxing. This trust-on-first-use model assumes all Hub packages are benign, creating a supply chain attack vector. The CPE data is incomplete (cpe:2.3:a:n/a:n/a), reflecting the package's relative obscurity in vulnerability databases, though the GitHub repository at guardrails-ai/guardrails confirms the product identity.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. The Notion page at https://www.notion.so/CVE-2026-31233-35d1e13931888142a954fb3f50ee0c94 may contain vendor remediation guidance but access requires authentication. Monitor the GitHub repository https://github.com/guardrails-ai/guardrails for security advisories and commit history indicating input validation fixes to the Hub installation mechanism. As compensating controls until a confirmed patch: (1) Avoid installing third-party validator packages from Guardrails Hub in production environments - this eliminates the attack vector entirely but breaks Hub ecosystem functionality. (2) Review Hub package manifests manually before installation by inspecting the post_install field in package metadata, though this requires technical expertise and defeats convenience. (3) Run guardrails hub install commands only in isolated containers or VMs with no access to sensitive data or credentials, containing potential RCE impact but adding operational overhead. (4) Implement network egress filtering to block outbound connections from ML training environments, preventing post-exploitation command-and-control but potentially breaking legitimate package dependencies. Each mitigation trades functionality or operational simplicity for security.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today