CVE-2026-31233 json
Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
published 5mo ago modified 13d ago also GHSA-r6hf-g5x6-7pv9 , PYSEC-2026-347 , EUVD-2026-29556
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post_install field. The script path is constructed from untrusted manifest data and executed without proper validation or sanitization, allowing remote code execution. An attacker who can publish malicious packages to the Hub can inject arbitrary code that will be executed on any system where a victim installs the malicious package.
Is CVE-2026-31233 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 5mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | guardrails-ai | <=0.6.7 |
no fix listed |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/guardrails-ai/guardrails
package
-
notion.so
/CVE-2026-31233-35d1e13931888142a954fb3f50ee0c94
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-31233
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/guardrails-ai/PYSEC-2026-347.yaml
web
-
pypi.org
/project/guardrails-ai
web, package
-
github.com
/advisories/GHSA-r6hf-g5x6-7pv9
advisory
Sources
- CVE List CVE-2026-31233
- GitHub Advisory GHSA-r6hf-g5x6-7pv9
- NVD CVE-2026-31233
- OSV PYSEC-2026-347
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.