GitHub Advisoryadvisory · PyPI

GHSA-w392-75q8-vr67 Guardrails has an arbitrary code execution vulnerability

HIGH Published 2024-09-18 Modified 2024-09-18 Official page ↗
Aliases
CVE-2024-45858
Ecosystem
PyPI
Packages
guardrails-ai
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-95
Reviewed
2024-09-18

Affected packages

• PyPI guardrails-ai: >= 0.2.9, < 0.5.10 → fixed in 0.5.10

Description

An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.

Related

Alias · CVE (1)

  • CVE-2024-45858 An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the… vulnerability

Weakness · CWE (1)

  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References