Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. Aany user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-06 | 2 | Active Exploitation1General1 |
| 2026-06-08 | 1 | General1 |
| 2026-06-23 | 1 | General1 |
CVE-2026-45758: critical severity (CVSS 9.6). Scope affected systems for a supply-chain compromise issue. Scope it today so nobody has to explain it tomorrow.
Post summary
The post merely notes that CVE‑2026‑45758 is a critical vulnerability (CVSS 9.6) tied to a supply‑chain compromise, with no further actionable details.
🔴 Guardrails #AI (#Python framework), Supply Chain Attack, #CVE-2026-45758 (Critical) -DC-Jun2026-278 https://dailycve.com/guardrails-ai-python-framework-supply-chain-attack-cve-2026-45758-critical-dc-jun2026-278/
Post summary
A newly disclosed critical supply‑chain vulnerability (CVE‑2026‑45758) affecting Guardrails AI’s Python framework is announced, but no proof‑of‑concept, exploit code, patch, or detailed technical data are provided.
CVE-2026-45758 Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `… https://www.cve.org/CVERecord?id=CVE-2026-45758
Post summary
An attacker released a malicious version of the Guardrails AI framework, indicating active exploitation of CVE‑2026‑45758, though the post lacks detailed technical or mitigation information.
CVE-2026-45758 Malicious Package Distribution in Guardrails AI 0.10.1 on PyPI https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45758
Post summary
The post merely references CVE-2026-45758 with a headline and a link to a vulnerability database, offering no technical or actionable details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | guardrailsai | guardrails_ai | 0.10.1 | python | - |