What’s Vulnerable › Vulnerabilities

CVE-2024-52524: ReDoS in Giskard Scan text perturbation

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-14 · updated 2026-06-17
• Weakness: CWE-1333

Description

Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.

Affected products

• Giskard-AI Giskard: before 2.15.5 — fixed in 2.15.5

How to fix

Upgrade to a fixed version: Giskard-AI Giskard 2.15.5. Check the vendor advisory for mitigations.

References

• https://github.com/Giskard-AI/giskard/commit/48ce81f5c626171767188d6f0669498fb613b4d3
• https://github.com/Giskard-AI/giskard/security/advisories/GHSA-pjwm-cr36-mwv3

Get alerted when CVE-2024-52524 or the next vulnerability affects your stack