PT-2024-38000 · Unknown · Guardrails Ai

Natan Nehorai · Published 2024-07-21 · Updated 2024-11-25 · CVE-2024-6961

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Guardrails AI (affected versions not specified)

Description The issue concerns RAIL documents, an XML-based format used by Guardrails AI for enforcing formatting checks on LLM outputs. Users who consume RAIL documents from external sources are at risk of XML External Entity (XXE) attacks, which could lead to the leakage of internal file data through the SYSTEM entity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-6961

GHSA-F8HX-F4XW-C646

Affected Products

Guardrails Ai

References · 8

• https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6961 · Security Note
• https://osv.dev/vulnerability/GHSA-f8hx-f4xw-c646 · Vendor Advisory
• https://github.com/guardrails-ai/guardrails · Note
• https://github.com/guardrails-ai/guardrails/commit/f3d806afee31e2e3f97af682d16c3c1bc0d3c380 · Note
• https://github.com/guardrails-ai/guardrails/pull/922 · Note
• https://t.me/cvenotify/86934 · Telegram Post
• https://t.me/cvedetector/1342 · Telegram Post