GHSA-rq2q-4r55-9877

Source

https://github.com/advisories/GHSA-rq2q-4r55-9877

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rq2q-4r55-9877/GHSA-rq2q-4r55-9877.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rq2q-4r55-9877

Aliases

Published

2026-04-14T23:13:39Z

Modified

2026-07-13T16:42:45Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
1.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L CVSS Calculator

Summary

Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check

Details

Summary

The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that trigger catastrophic backtracking in the regex engine, causing the process to hang indefinitely and denying service to all other operations.

giskard-checks is a local developer testing library. Check definitions, including the pattern parameter, are provided in application code or configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite. The absence of a regex timeout could cause availability issues in automated environments such as CI/CD pipelines.

Affected component

text_matching.py, line 457: re.search(pattern, text)

Remediation

Upgrade to giskard-checks >= 1.0.2b1.

Credit

Giskard-AI thanks @dhabaleshwar for identifying the missing timeout on regex evaluation.

Database specific

{
    "cwe_ids":  [
        "CWE-1333"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-14T23:13:39Z",
    "nvd_published_at":  "2026-04-17T18:16:32Z",
    "severity":  "LOW"
}

References

Affected packages

PyPI / giskard-checks

Package

Name: giskard-checks; View open source insights on deps.dev
Purl: pkg:pypi/giskard-checks

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.2b1

Affected versions

1.*

1.0.1a1

1.0.1a2

1.0.1b1

Database specific

last_known_affected_version_range

"<= 1.0.1b1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-rq2q-4r55-9877/GHSA-rq2q-4r55-9877.json"