{"id":"CVE-2026-31233","kind":"vulnerability","aliases":["CVE-2026-31233","GHSA-r6hf-g5x6-7pv9"],"related":[],"title":"Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism","description":"Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post_install field. The script path is constructed from untrusted manifest data and executed without proper validation or sanitization, allowing remote code execution. An attacker who can publish malicious packages to the Hub can inject arbitrary code that will be executed on any system where a victim installs the malicious package.","summary":"Guardrails AI through 0.6.7 runs a post_install script named in a Hub validator manifest without validating its path. An attacker who publishes a malicious validator package can get code executed on any machine that installs it.","severity":"critical","cvss":9.8,"epss":0.00635,"exploited":false,"exploited_at":null,"products":[{"name":"guardrails-ai","fixed":[],"affected":"<= 0.6.7","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","ci","cwe-94","developer-machines","guardrails-ai","python"],"not_affected_if":["no-hub-install","pinned-newer-version"],"how_to_check":"- Run `pip show guardrails-ai` and check whether the version is `0.6.7` or older.\n- Look for validator packages installed with `guardrails hub install` in the project's requirements or install logs.","fix":"- Upgrade `guardrails-ai` to a version later than `0.6.7`; the fixed version is unknown from the sources.\n- Until upgraded, avoid running `guardrails hub install` on untrusted validator packages.","status":"open","published_at":"2026-05-12T18:16:51+00:00","first_seen_at":"2026-10-27T16:51:11+00:00","triaged_at":"2026-10-27T16:52:26+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T16:52:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `guardrails-ai` to a version later than `0.6.7`; the fixed version is unknown from the sources.\n- Until upgraded, avoid running `guardrails hub install` on untrusted validator packages.","reach":"internet","title":"Guardrails AI: Hub install lets a malicious manifest run code","impact":"high","summary":"Guardrails AI through 0.6.7 runs a post_install script named in a Hub validator manifest without validating its path. An attacker who publishes a malicious validator package can get code executed on any machine that installs it.","category":"ai-tooling","nicknames":[],"who_cares":["python","guardrails-ai","ci","developer-machines"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker code runs on the installing machine with its privileges","analyst_note":"Find the first fixed version and the upstream patch in GHSA-r6hf-g5x6-7pv9; the sources do not name it.","how_to_check":"- Run `pip show guardrails-ai` and check whether the version is `0.6.7` or older.\n- Look for validator packages installed with `guardrails hub install` in the project's requirements or install logs.","needs_analyst":true,"not_affected_if":["no-hub-install","pinned-newer-version"],"who_is_affected":"Teams that install validators from the Guardrails Hub with `guardrails hub install` on machines running guardrails-ai 0.6.7 or older. The exposure comes from the install step, so a service that already has its validators installed and never runs the install command again is less exposed. Teams that do not use the Hub install mechanism can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000643,"input_tokens":3457,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A '-31233':16A,24A '-94':33B,87C '0.6.7':44B,80C '7pv9':21A 'ai':2A,27A,29B,39B,42B,78C 'ai-tool':28B 'allow':138C 'arbitrari':154C 'attack':61B,143C 'ci':31B 'code':5A,70B,83C,140C,155C 'construct':126C 'contain':3A,81C 'cve':14A,22A 'cwe':32B,86C 'data':130C 'develop':35B 'developer-machin':34B 'dynam':112C 'execut':71B,113C,132C,141C,159C 'field':121C 'g5x6':20A 'get':69B 'ghsa':18A 'ghsa-r6hf-g5x6-7pv9':17A 'guardrail':1A,38B,41B,77C,99C,109C 'guardrails':26A 'guardrails-ai':25A,37B 'hub':10A,53B,90C,100C,110C,151C 'inject':6A,84C,153C 'instal':12A,48B,76B,92C,95C,101C,120C,166C 'machin':36B,74B 'malici':65B,147C,168C 'manifest':55B,106C,129C 'mechan':13A,93C 'name':50B 'packag':11A,67B,91C,97C,148C,169C 'path':59B,124C 'post':47B,119C 'proper':134C 'publish':63B,146C 'python':40B 'r6hf':19A 'remot':139C 'retriev':104C 'run':45B 'sanit':137C 'script':49B,115C,123C 'specifi':116C 'system':103C,162C 'thru':79C 'tool':30B 'untrust':128C 'valid':54B,57B,66B,96C,135C 'via':98C 'victim':165C 'vulner':7A,85C 'without':56B,133C","nicknames":[],"mitigations":[],"who_affected":"Teams that install validators from the Guardrails Hub with `guardrails hub install` on machines running guardrails-ai 0.6.7 or older. The exposure comes from the install step, so a service that already has its validators installed and never runs the install command again is less exposed. Teams that do not use the Hub install mechanism can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-12T18:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r6hf-g5x6-7pv9","url":"https://github.com/advisories/GHSA-r6hf-g5x6-7pv9","severity":"critical","published_at":"2026-05-12T18:30:40+00:00","modified_at":"2026-10-27T16:47:45+00:00","first_seen_at":"2026-10-27T16:51:11+00:00","fetched_at":"2026-10-27T16:51:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-31233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31233","severity":null,"published_at":"2026-05-12T18:16:51+00:00","modified_at":"2026-06-17T10:33:28+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}