CVE-2026-45758
CRITICALDescription
Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. Aany user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.
Is your site exposed to CVE-2026-45758?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| guardrailsai | guardrails_ai |
References
Frequently Asked Questions
What is CVE-2026-45758? +
How severe is CVE-2026-45758? +
What products are affected by CVE-2026-45758? +
How do I check if I'm vulnerable to CVE-2026-45758? +
Related Vulnerabilities
simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing …
color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string …
color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was …
debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after …
color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken …
backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after …