p PatchFirst

CVE-2024-45858

CVE-2024-45858

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.

CVSS 7.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • guardrails

    Versions
    • ≥ 0.2.9, < 0.5.10: Affected (semver)

    Update to 0.5.10

  • guardrails-ai PyPI

    Versions
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.4.5
    • 0.5.0
    • 0.5.0a0
    • 0.5.0a1
    • 0.5.0a10
    • 0.5.0a11
    • 0.5.0a12
    • 0.5.0a13
    • 0.5.0a2
    • 0.5.0a3
    • 0.5.0a4
    • 0.5.0a5
    • 0.5.0a6
    • 0.5.0a7
    • 0.5.0a8
    • 0.5.0a9
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.5.5
    • 0.5.6
    • 0.5.7
    • 0.5.8
    • 0.5.9
    Affected ranges
    • ECOSYSTEM: ≥ 0.2.9, < 0.5.10

    Update to 0.5.10

Original sources

Check your server →