Guardrails AI, a Python framework for building AI applications, was compromised when an attacker published a malicious version 0.10.1 to the Python Package Index (PyPI) on May 11, 2026. The malicious package contained injected code that would execute whenever a user installed or imported it, enabling arbitrary code execution on the host machine (CWE‑506). If any credential or key is reachable by the process, the attacker could obtain them for further exploitation.

The vulnerability affects any installation of guardrails‑ai 0.10.1 that was fetched from PyPI during the window around May 11, 2026. Both the 0.10.2 release and the 0.10.0 release predating the compromise contain no malicious code and are unaffected.

The CVSS base score of 9.6 indicates a critical severity, and although the EPSS score is currently unavailable, the fact that the package was publicly available and automatically distributed to any Python environment means the exploitability is high. The vulnerability is not listed in the CISA KEV catalog yet, but the lack of immediate detection does not reduce the potential impact of an attacker who successfully injects malicious code. The most likely attack vector is via the PyPI repository itself, where users unknowingly install the compromised package.