Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS13MzkyLTc1cTgtdnI2N84AA_qa
Guardrails has an arbitrary code execution vulnerability
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.
Permalink: https://github.com/advisories/GHSA-w392-75q8-vr67JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13MzkyLTc1cTgtdnI2N84AA_qa
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 25 days ago
Updated: 25 days ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Identifiers: GHSA-w392-75q8-vr67, CVE-2024-45858
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-45858
- https://hiddenlayer.com/sai-security-advisory/2024-09-guardrails
- https://github.com/guardrails-ai/guardrails/commit/ab12701e8c3ef41273ff9b3912f2e4e28ae8306f
- https://github.com/advisories/GHSA-w392-75q8-vr67
Blast Radius: 5.3
Affected Packages
pypi:guardrails-ai
Dependent packages: 4Dependent repositories: 4
Downloads: 38,782 last month
Affected Version Ranges: >= 0.2.9, < 0.5.10
Fixed in: 0.5.10
All affected versions: 0.2.9, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.9
All unaffected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.5.10, 0.5.11, 0.5.12, 0.5.13