# CVE-2026-31233: Guardrails AI code injection in Hub package installation

Source: https://junglewise.ai/threats/cve-2026-31233-guardrails-ai-code-injection-in-hub-package-installation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-31233 · Severity: critical · CVSS 9.8 · Published 2026-05-12

Guardrails AI, a tool used to ensure safety and reliability in Large Language Model (LLM) outputs, contains a critical security flaw in its package installation system. An attacker could publish a malicious package to the Guardrails Hub that, when installed by a user, automatically runs harmful code on the user's computer. This could lead to a total system takeover, theft of sensitive data, or disruption of business operations.

Technologies: [guardrails-ai (PyPI)](https://junglewise.ai/threats/technologies/pypi-guardrails-ai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-31233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31233 being exploited in the wild.

**How severe is CVE-2026-31233?** Critical severity, with a CVSS score of 9.8, published 12 May 2026.

**Which products and versions are affected?** Guardrails AI <= 0.6.7, up to and including 0.6.7; guardrails-ai (PyPI) ECOSYSTEM:introduced=0,last_affected=0.6.7.

**Is there a fix for CVE-2026-31233?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31233 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-31233?** Check whether you run Guardrails AI or guardrails-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in the Guardrails AI Hub package installation mechanism. When a user executes the 'guardrails hub install' command, the system fetches a manifest from the Hub and dynamically executes a script defined in the 'post_install' field. Because the script path is constructed from untrusted manifest data without sufficient validation or sanitization, an attacker who successfully publishes a malicious package to the Hub can achieve remote code execution (RCE) on the victim's machine. The vulnerability is present in versions up to and including 0.6.7; as of the advisory date, no patched version is specified.

## Affected products

- Guardrails AI guardrails-ai <= 0.6.7

## Identifiers

- CVE-2026-31233
- GHSA-r6hf-g5x6-7pv9
- PYSEC-2026-347

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory: Published to GitHub Advisory Database and NVD
- 2026-05-27: other: Advisory updated and reviewed by GitHub

## References

- [https://github.com/guardrails-ai/guardrails](https://github.com/guardrails-ai/guardrails)
- [https://www.notion.so/CVE-2026-31233-35d1e13931888142a954fb3f50ee0c94](https://www.notion.so/CVE-2026-31233-35d1e13931888142a954fb3f50ee0c94)

## Related threats

- [PYSEC-2026-1432 - Guardrails has an arbitrary code execution vulnerability](https://junglewise.ai/threats/cve-2024-45858-guardrails-has-an-arbitrary-code-execution-vulnerability)
- [PYSEC-2026-1431 - Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2024-6961-guardrails-ai-vulnerable-to-improper-restriction-of-xml-external)
- [Guardrails AI embedded malicious code in PyPI package](https://junglewise.ai/threats/cve-2026-45758-guardrails-ai-embedded-malicious-code-in-pypi-package)