CVE-2024-45858
Last modified
CVE-2024-45858 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-45858?
How severe is CVE-2024-45858?
How do I fix CVE-2024-45858?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45852Deserialization of untrusted data can occur in versions 23.3…8.8
- CVE-2024-45853Deserialization of untrusted data can occur in versions 23.1…7.5
- CVE-2024-45854Deserialization of untrusted data can occur in versions 23.1…7.5
- CVE-2024-45855Deserialization of untrusted data can occur in versions 23.1…7.5
- CVE-2024-45856A cross-site scripting (XSS) vulnerability exists in all ver…5.4
- CVE-2024-45857Deserialization of untrusted data can occur in versions 2.4.…7.8
- CVE-2024-4586A vulnerability has been found in DedeCMS 5.7 and classified…4.3
- CVE-2024-45861Kastle Systems firmware prior to May 1, 2024, contained a ha…7.5
- CVE-2024-45862Kastle Systems firmware prior to May 1, 2024, stored machine…7.5
- CVE-2024-45863A null-dereference vulnerability involving parsing requests …5.3
- CVE-2024-4587A vulnerability was found in DedeCMS 5.7 and classified as p…4.3
- CVE-2024-45870Bandisoft BandiView 7.05 is vulnerable to Incorrect Access C…6.5
Are you affected by CVE-2024-45858?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST