CVE-2026-40319
Medium
Description
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
SeverityMedium
CVSS5.5
Exploit probability—
ProductGiskard
PublishedApr 17, 2026
First seenApr 17, 2026
Weakness typeCWE-1333CWE-1333
How to fix
Update
- giskard giskard1.0.2 or later
- giskard-checks1.0.2b1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| giskard giskard | v < 1.0.2 | 1.0.2 |
| giskard-checksPyPI | v < 1.0.2b1 | 1.0.2b1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.