TI-2026-29097 Aliases CVE-2026-40320 GHSA-7xjm-g8f4-rp26

Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck

LOW 25CWE-1336Published 2026-04-17 · Updated 2026-04-20

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00144 3rd percentileScored 2026-11-07

Fix Fixed giskard-oss (Giskard-AI): 1.0.2b1giskard-checks (PyPI): 1.0.2b1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Giskard-AI	giskard-oss	before 1.0.2b1	1.0.2b1	Patch available	CNA
—	giskard-checks (PyPI)	before 1.0.2b1	1.0.2b1	Patch available	GHSA-7xjm-g8f4-rp26

giskard-oss VendorGiskard-AI Affected before 1.0.2b1 Fixed in 1.0.2b1 Patch available CNA
giskard-checks (PyPI) Vendor— Affected before 1.0.2b1 Fixed in 1.0.2b1 Patch available GHSA-7xjm-g8f4-rp26

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:giskard:giskard::::::::	before 1.0.2	Vulnerable	Giskard-AI

cpe:2.3:a:giskard:giskard:*:*:*:*:*:*:*:* Versions before 1.0.2 Vulnerable ·Giskard-AI

Remediation

Fix · CNA giskard-oss (Giskard-AI) Fixed in 1.0.2b1
Fix · GHSA-7xjm-g8f4-rp26 giskard-checks (PyPI) Fixed in 1.0.2b1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-40320
2026-10-03 Alias added: GHSA-7xjm-g8f4-rp26

References

Advisory 2

Other 2

TI-2026-29096 Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check CVSS 4.0LOW 1.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences