Guardrails AI is a Python framework that helps build AI applications

CVE-2026-45758 is not a normal coding flaw in Guardrails AI; it is a malicious PyPI release. The affected population is extremely specific: guardrails-ai==0.10.1, published to PyPI on May 11, 2026, with maintainers saying users who installed that exact version during the short exposure window are affected; 0.10.0 and earlier were called safe, and PyPI later shows 0.10.2 released on June 4, 2026 as the current clean line.

The vendor's CRITICAL 9.6 is fair for a host that actually installed the poisoned artifact, because import-time code execution turns a dependency update into host compromise. But for fleet prioritization across 10,000 hosts, that score overstates reality: this is not internet-reachable, requires your org to have consumed one exact bad package, and was reportedly identified and quarantined within about two hours, which sharply narrows the exposed population.

Why this verdict

• Start from 9.6, then cut for exact-version scope: only guardrails-ai==0.10.1 is affected, not a broad version range.
• Cut again for attacker position: this requires the victim to install or resolve the poisoned package; the attacker is piggybacking on software supply chain trust, not reaching you over the network.
• Cut again for short exposure window: maintainers say the malicious release was identified in about two hours and PyPI quarantined it, which materially reduces the fraction of real deployments that ever saw it.
• Do not cut for impact: on a host that imported the package, the reported behavior is remote payload execution on Linux, which is effectively host compromise.
• Do not cut for blast radius on CI: if the affected system is a shared runner or privileged developer workstation, the downstream value of stolen tokens can exceed the single-host impact.

Why not higher?

This is not a wormable network service bug or a broadly reachable remote exploit path. There is no KEV listing, EPSS is very low, and the affected population is sharply narrowed by the exact-version and time-window requirement.

Why not lower?

This was a real malicious package release, not a speculative weakness or lab-only PoC. Any environment that installed and imported the bad artifact should be treated as potentially compromised, which is too serious for MEDIUM or backlog treatment.

1. Block the artifact everywhere — Deny guardrails-ai==0.10.1 in PyPI proxies, artifact repositories, CI allowlists, and policy engines immediately, within hours because this has active exploitation evidence. This stops rehydration from old lockfiles, container rebuilds, and ad hoc notebook installs.
2. Isolate affected dev and CI hosts — Any host that installed or imported 0.10.1 should be treated as potentially compromised immediately, within hours. Prioritize CI runners, build agents, shared notebooks, and developer laptops with package-publish, cloud, or GitHub credentials because those hosts have the highest secondary blast radius.
3. Hunt for second-stage and secret abuse — Look for Python writing or executing temp payloads, outbound connections to the reported infrastructure, GitHub/org anomalies, and newly used cloud/API tokens immediately, within hours. This matters because uninstalling the package does not prove the attacker did nothing after import.
4. Enforce hash-pinned dependency resolution — Require hashes, approved mirrors, and provenance/attestation checks for Python packages within 30 days for the broader control fix aligned to a HIGH finding. This does not undo this incident, but it meaningfully reduces repeat risk from the same class of attack.

Run this on target developer workstations, CI runners, container images, and build hosts that may have installed Python dependencies. Invoke it with python3 check_guardrails_cve_2026_45758.py; no root is required for the current user context, but broader fleet sweeps across other users or system-wide locations may need elevated rights.

#!/usr/bin/env python3
# check_guardrails_cve_2026_45758.py
# Detect likely exposure to CVE-2026-45758 on a single host.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import sys
from pathlib import Path

try:
    from importlib import metadata as importlib_metadata
except Exception:
    import importlib_metadata  # type: ignore

PACKAGE = "guardrails-ai"
AFFECTED = "0.10.1"
SAFE_EXACT = {"0.10.0", "0.10.2"}

HOME = Path.home()
IOC_PATHS = [
    HOME / ".config" / "systemd" / "user" / "gh-token-monitor.service",
    HOME / "Library" / "LaunchAgents" / "com.user.gh-token-monitor.plist",
    Path("/tmp/transformers.pyz"),
]


def get_version(pkg_name: str):
    try:
        return importlib_metadata.version(pkg_name)
    except importlib_metadata.PackageNotFoundError:
        return None
    except Exception:
        return "ERROR"


def suspicious_paths_present():
    found = []
    for p in IOC_PATHS:
        try:
            if p.exists():
                found.append(str(p))
        except Exception:
            pass
    return found


def main():
    version = get_version(PACKAGE)
    found_iocs = suspicious_paths_present()

    if version == AFFECTED:
        print(f"VULNERABLE: {PACKAGE} {AFFECTED} is installed on this host")
        if found_iocs:
            print("IOC_PATHS=" + ", ".join(found_iocs))
        sys.exit(1)

    if found_iocs:
        print("VULNERABLE: suspicious campaign-related artifacts found: " + ", ".join(found_iocs))
        sys.exit(1)

    if version is None:
        print(f"UNKNOWN: {PACKAGE} is not installed in this Python environment; check other environments, images, and lockfiles")
        sys.exit(2)

    if version in SAFE_EXACT:
        print(f"PATCHED: {PACKAGE} {version} is a known safe version for this CVE")
        sys.exit(0)

    # Exact affected version is known; other versions are likely not affected, but stay conservative.
    try:
        if version != AFFECTED:
            print(f"PATCHED: {PACKAGE} {version} is not the known malicious version {AFFECTED}")
            sys.exit(0)
    except Exception:
        pass

    print(f"UNKNOWN: unable to confidently assess installed version state for {PACKAGE} ({version})")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. GitHub Advisory Database
2. Guardrails AI SECURITY_ADVISORY.md
3. Guardrails AI issue #1473
4. PyPI project page
5. GitLab Advisory Database
6. CISA Known Exploited Vulnerabilities Catalog
7. Socket package analysis for guardrails-ai 0.10.1
8. Cloud Security Alliance campaign research note