Giskard RegexMatching Check Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the RegexMatching check of the Giskard testing framework for AI models, in versions prior to 1.0.2b1. The issue arises because user-supplied regular expression patterns are passed directly to Python's re.search() function without any timeout or complexity validation. This can lead to catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and the execution of the test suite, potentially disrupting automated workflows such as CI/CD pipelines.

Impact

Exploitation of this vulnerability can cause the process to hang indefinitely, leading to availability issues, especially in automated environments like CI/CD pipelines.

Remediation

Users can upgrade to Giskard version 1.0.2b1 or later to address this vulnerability.