Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M
CVE-2026-40319Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Low 1.0
In plain English
A low-severity regular-expression denial of service in giskard-oss from Giskard-AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | giskard-checks | 1.0.2b1 | GHSA-rq2q-4r55-9877 |
| PyPI | giskard-checks | 1.0.2b1 | PYSEC-2026-2489 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Giskard-AI | giskard-oss | < 1.0.2b1 |
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L