---
title: "CVE-2026-45758: Malicious code in guardrails-ai 0.10.1 (supply chain compromise)"
url: https://erroneo.us/security/cve/CVE-2026-45758/
description: "CVE-2026-45758 (guardrails-ai (PyPI)): Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-06-05
date_modified: 2026-06-09
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-45758"
kev: false
cvss: 9.6
epss: 0.0049
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-45758: Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 41: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 41% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Only applies if your dependency tree includes guardrails-ai (PyPI) = 0.10.1, no fixed version listed . Check your lockfile, including transitive dependencies.

## What it is

Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai (0.10.1) to PyPI. Aany user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.

## Affected packages

- PyPI `guardrails-ai` = 0.10.1 → fixed: none listed

## Affected products (CVE record)

- guardrails-ai guardrails: = 0.10.1

## Severity

- GitHub_M CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.49% probability of exploitation activity in the next 30 days; percentile 41.

## Sources

- [GitHub Advisory GHSA-xmpw-2vmm-p4p6](https://github.com/advisories/GHSA-xmpw-2vmm-p4p6)
- [CVE.org record CVE-2026-45758](https://www.cve.org/CVERecord?id=CVE-2026-45758)
- [NVD entry CVE-2026-45758](https://nvd.nist.gov/vuln/detail/CVE-2026-45758)
- [github.com](https://github.com/guardrails-ai/guardrails/security/advisories/GHSA-xmpw-2vmm-p4p6)
- [github.com](https://github.com/guardrails-ai/guardrails/issues/1473)
- [github.com](https://github.com/guardrails-ai/guardrails/blob/main/SECURITY_ADVISORY.md)
- [github.com](https://github.com/pypa/advisory-database/tree/main/vulns/guardrails-ai/PYSEC-2026-206.yaml)

---
Source page: https://erroneo.us/security/cve/CVE-2026-45758/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt