CVE-2026-45758
CRITICALCVE-2026-45758 is a critical-severity (CVSS 9.6) vulnerability in guardrails-ai. O3 Security confirms whether CVE-2026-45758 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
Real-World Exposure
guardrails-aiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai (0.10.1) to PyPI.
Affected: any user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026.
Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, we have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through our systems.
For the full timeline, technical details, and remediation steps we have taken, see SECURITY_ADVISORY.md.
Patches
No patched version above 0.10.1 is available yet. Downgrade to 0.10.0, which is unaffected.
Workarounds
1. Pin to a safe version:
guardrails-ai==0.10.0
2. While the PyPI quarantine is active, install from GitHub:
pip install git+https://github.com/guardrails-ai/[email protected]
The v0.10.0 tag in this repository is clean. Track quarantine status here: #1473.
3. If you installed 0.10.1, treat the host as potentially compromised. Rotate any credentials accessible from that machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit your GitHub account for unauthorized workflows or repositories.
4. Snowglobe and Guardrails Hub users : all Snowglobe and Guardrails Hub API keys will be invalidated at 2:00 PM Pacific on May 13, 2026. Rotate yours before then to avoid service interruption.
References
- Full advisory, timeline, and remediation details: SECURITY_ADVISORY.md
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | guardrails-ai | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for guardrails-ai. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Remediation status
No patched version of guardrails-ai has shipped for CVE-2026-45758 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-45758 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-45758. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-45758 in your dependencies?
O3 detects CVE-2026-45758 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.