Medium severity5.9GHSA Advisory· Published Jul 21, 2024· Updated Apr 15, 2026
CVE-2024-6961
CVE-2024-6961
Description
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
guardrails-aiPyPI | < 0.5.0 | 0.5.0 |
Affected products
2- Range: < 0.5.0
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-f8hx-f4xw-c646ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-6961ghsaADVISORY
- github.com/guardrails-ai/guardrails/commit/f3d806afee31e2e3f97af682d16c3c1bc0d3c380ghsaWEB
- github.com/guardrails-ai/guardrails/pull/922ghsaWEB
- research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519ghsaWEB
- research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519/nvd
News mentions
0No linked articles in our index yet.