Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS13MzkyLTc1cTgtdnI2N84AA_qa

Guardrails has an arbitrary code execution vulnerability

An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.

Permalink: https://github.com/advisories/GHSA-w392-75q8-vr67
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13MzkyLTc1cTgtdnI2N84AA_qa
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 month ago
Updated: about 1 month ago


CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-w392-75q8-vr67, CVE-2024-45858
References: Repository: https://github.com/guardrails-ai/guardrails
Blast Radius: 5.3

Affected Packages

pypi:guardrails-ai
Dependent packages: 4
Dependent repositories: 4
Downloads: 54,149 last month
Affected Version Ranges: >= 0.2.9, < 0.5.10
Fixed in: 0.5.10
All affected versions: 0.2.9, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.9
All unaffected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.5.10, 0.5.11, 0.5.12, 0.5.13, 0.5.14