Live › vulnerability › CVE-2026-31233
Go to dashboardGuardrails AI through 0.6.7 runs a post_install script named in a Hub validator manifest without validating its path. An attacker who publishes a malicious validator package can get code executed on any machine that installs it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:51 UTC, 0h before NVD. All times on this page are UTC.
Teams that install validators from the Guardrails Hub with on machines running guardrails-ai 0.6.7 or older. The exposure comes from the install step, so a service that already has its validators installed and never runs the install command again is less exposed. Teams that do not use the Hub install mechanism can skip it.
guardrails hub install| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| guardrails-ai | pypi | <= 0.6.7 | – |
pip show guardrails-ai and check whether the version is 0.6.7 or older.guardrails hub install in the project's requirements or install logs.guardrails-ai to a version later than 0.6.7; the fixed version is unknown from the sources.guardrails hub install on untrusted validator packages.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post_install field. The script path is constructed from untrusted manifest data and executed without proper validation or sanitization, allowing remote code execution. An attacker who can publish malicious packages to the Hub can inject arbitrary code that will be executed on any system where a victim installs the malicious package.
This page as .md · .json · in your agent: get_signal("CVE-2026-31233")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.