---
id: "CVE-2026-31233"
kind: "vulnerability"
aliases: ["CVE-2026-31233", "GHSA-r6hf-g5x6-7pv9"]
title: "Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism"
severity: "critical"
cvss: 9.8
epss: 0.00635
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "guardrails-ai", "fixed": [], "affected": "<= 0.6.7", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "ci", "cwe-94", "developer-machines", "guardrails-ai", "python"]
not_affected_if: ["no-hub-install", "pinned-newer-version"]
published_at: "2026-05-12T18:16:51+00:00"
first_seen_at: "2026-10-27T16:51:11+00:00"
updated_at: "2026-10-27T17:03:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-r6hf-g5x6-7pv9", "first_seen_at": "2026-10-27T16:51:11+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31233", "first_seen_at": "2026-10-27T17:03:04+00:00"}]
---

# Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI through 0.6.7 runs a post_install script named in a Hub validator manifest without validating its path. An attacker who publishes a malicious validator package can get code executed on any machine that installs it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:guardrails-ai affected <= 0.6.7 fixed ?

## How to check

- Run `pip show guardrails-ai` and check whether the version is `0.6.7` or older.
- Look for validator packages installed with `guardrails hub install` in the project's requirements or install logs.

## Fix

- Upgrade `guardrails-ai` to a version later than `0.6.7`; the fixed version is unknown from the sources.
- Until upgraded, avoid running `guardrails hub install` on untrusted validator packages.

## Timeline

- 2026-10-27T16:51:11+00:00 ghsa https://github.com/advisories/GHSA-r6hf-g5x6-7pv9
- 2026-10-27T17:03:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-31233

## From the sources

Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post_install field. The script path is constructed from untrusted manifest data and executed without proper validation or sanitization, allowing remote code execution. An attacker who can publish malicious packages to the Hub can inject arbitrary code that will be executed on any system where a victim installs the malicious package.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_