CVE-2024-52524
ReDoS in Giskard Scan text perturbation
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.9EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
14 Nov 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Clear
Affected products
Giskard-AI · giskardWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →