CVE-2024-52524
ReDoS in Giskard Scan text perturbation
- State
- Published
- Severity
- 6.9 Medium
- Published
- Nov 14, 2024
- Updated
- Nov 21, 2024
- Reserved
- Nov 11, 2024
Description
Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Clear | GitHub_M |
Weaknesses
- CWE-1333 Inefficient Regular Expression Complexity
Affected Products
| Product | Versions |
|---|---|
giskardGiskard-AI |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.