CVE-2024-52524CWE-1333

ReDoS in Giskard Scan text perturbation

Medium · published November 14, 2024

CVSS v4.0
6.9
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Clear
EPSS
0.00817 · 56.7th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-11-14T17:21Z
EPSS history
Timeline
  • 14 NOV 17:21Z
    ReDoS in Giskard Scan text perturbation
    cvelistv5