gcdRadar
archive/Supply chain/AIR-2026-0654
closedclosed 12 May 2026Supply chain2 Disclosed vulnerabilityAI

CVE-2026-31233: Guardrails AI code injection in Hub installer

Guardrails AI

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism due to unsanitized script execution from manifests. Attackers can publish malicious packages to execute arbitrary code on victim systems.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
9.8
EPSS
0.01 · top 49% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
12 May 2026
last update
12 May 2026
CVE ids
CVE-2026-31233other records

Timeline · 1

  1. 12 May 2026CVE-2026-31233: Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Sources · 1

Advisories and databases

  1. 2026-05-12
    CVE-2026-31233: Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
    GitHub Advisory Database · github.com/advisories/GHSA-r6hf-g5x6-7pv9

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Supply chain
AI role
Attack on AI
categories
Supply chainInfrastructure vulnerability
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
AML.T0010 AI Supply Chain Compromise
tags
code-injectionrce
dates
happened 12 May 2026 · first reported 12 May 2026
origin
GitHub Advisory Database
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 07:00Z · updated 2026-10-18 07:00Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# CVE-2026-31233: Guardrails AI code injection in Hub installer

https://gcdradar.vercel.app/incidents/cve-2026-31233-guardrails-ai-code-injection-in-hub-installer · AIR-2026-0654 · closed 2026-05-12

- Lane: Supply chain
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-05-12
- AI role: Attack on AI
- Products: Guardrails AI
- CVE ids: CVE-2026-31233
- CVSS: 9.8

## Summary

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism due to unsanitized script execution from manifests. Attackers can publish malicious packages to execute arbitrary code on victim systems.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-05-12: CVE-2026-31233: Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism (https://github.com/advisories/GHSA-r6hf-g5x6-7pv9)

## Sources

- 2026-05-12 GitHub Advisory Database: CVE-2026-31233: Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism https://github.com/advisories/GHSA-r6hf-g5x6-7pv9

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed6.5
    vLLM CVE-2026-47155: vLLM artifact pin decay allows loading unpinned code and weights

    Patch now · Disclosed · since 10 Jun 2026 · updated 22 Jun 2026 · CVE-2026-47155

    AI
  2. closed8.8
    vLLM vLLM Hardcoded Trust Remote Code Parameter Leads to RCE

    Patch now · Disclosed · since 28 May 2026 · CVE-2026-4944

    AI
  3. closed8.8
    vLLM CVE-2026-5817: Docker Model Runner vllm-metal arbitrary code execution vulnerability

    Patch now · Disclosed · since 22 May 2026 · CVE-2026-5817

    AI
  4. closed8.2
    LangChain family CVE-2026-44843: LangChain vulnerable to unsafe deserialization

    Patch now · Disclosed · since 8 May 2026 · updated 26 May 2026 · CVE-2026-44843

    AI
  5. closed8.8
    Hugging Face libraries Hugging Face Diffusers custom pipeline trust_remote_code bypass vulnerability

    Patch now · Disclosed · since 7 May 2026 · CVE-2026-44827

    AI
  6. closed8.8
    Hugging Face libraries Hugging Face Diffusers trust_remote_code bypass allows remote code execution

    Patch now · Disclosed · since 7 May 2026 · CVE-2026-44513

    AI