Vulnerability · Published Nov 14, 2024 · Assigned by GitHub_M
CVE-2024-52524ReDoS in Giskard Scan text perturbation
Medium 6.9
In plain English
A medium-severity regular-expression denial of service in giskard from Giskard-AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | giskard | 2.15.5 | GHSA-pjwm-cr36-mwv3 |
| PyPI | giskard | 2.15.5 | PYSEC-2026-1403 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Giskard-AI | giskard | < 2.15.5 |
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Clear