Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-40319

Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e8dfd67629365ce3b039b3466869bd689c884e776e9d606c13ab87bfb423b211
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"giskard-oss","vendor":"Giskard-AI","versions":[{"status":"affected","version":"< 1.0.2b1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:37124bf48e78c827c3ed2808b028b855b4c2bd14dac21acafd4f60146c31ef6e · sha256:1d8360a4b04e6fd6… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":1,"baseSeverity":"LOW","privilegesRequired":"LOW","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:37124bf48e78c827c3ed2808b028b855b4c2bd14dac21acafd4f60146c31ef6e · sha256:1d8360a4b04e6fd6… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-1333","description":"CWE-1333: Inefficient Regular Expression Complexity","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:37124bf48e78c827c3ed2808b028b855b4c2bd14dac21acafd4f60146c31ef6e · sha256:1d8360a4b04e6fd6… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1","tags":["x_refsource_MISC"],"url":"https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:37124bf48e78c827c3ed2808b028b855b4c2bd14dac21acafd4f60146c31ef6e · sha256:1d8360a4b04e6fd6… · /containers/cna/references/1
{"name":"https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-rq2q-4r55-9877","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-rq2q-4r55-9877"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:37124bf48e78c827c3ed2808b028b855b4c2bd14dac21acafd4f60146c31ef6e · sha256:1d8360a4b04e6fd6… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer