CVE-2026-40320

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40320", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T21:41:54.505Z", "datePublished": "2026-04-17T17:25:50.449Z", "dateUpdated": "2026-04-20T13:46:09.036Z"}, "containers": {"cna": {"title": "Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-7xjm-g8f4-rp26", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-7xjm-g8f4-rp26"}, {"name": "https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1"}], "affected": [{"vendor": "Giskard-AI", "product": "giskard-oss", "versions": [{"version": "< 1.0.2b1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T17:25:50.449Z"}, "descriptions": [{"lang": "en", "value": "Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1."}], "source": {"advisory": "GHSA-7xjm-g8f4-rp26", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40320", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:43:55.511255Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:46:09.036Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40320", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:43:55.511255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:45:11.086Z"}}], "cna": {"title": "Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck", "source": {"advisory": "GHSA-7xjm-g8f4-rp26", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Giskard-AI", "product": "giskard-oss", "versions": [{"status": "affected", "version": "< 1.0.2b1"}]}], "references": [{"url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-7xjm-g8f4-rp26", "name": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-7xjm-g8f4-rp26", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1", "name": "https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T17:25:50.449Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40320", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:46:09.036Z", "dateReserved": "2026-04-10T21:41:54.505Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T17:25:50.449Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "giskard-oss", "vendor": "Giskard-AI", "versions": [{"status": "affected", "version": "< 1.0.2b1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:giskard:giskard:*:*:*:*:*:*:*:*", "matchCriteriaId": "496B53AF-647A-4314-A26E-72DB27C295C0", "versionEndExcluding": "1.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1."}, {"lang": "es", "value": "Giskard es un framework de pruebas de c\u00f3digo abierto para modelos de IA. En versiones anteriores a la 1.0.2b1, la clase ConformityCheck renderizaba el par\u00e1metro \u2019rule\u2019 a trav\u00e9s del constructor Template() predeterminado de Jinja2, interpretando silenciosamente las expresiones de plantilla en tiempo de ejecuci\u00f3n. Si las definiciones de verificaci\u00f3n se cargan desde una fuente no confiable, una cadena de regla manipulada podr\u00eda lograr la ejecuci\u00f3n de c\u00f3digo arbitrario. La explotaci\u00f3n requiere acceso de escritura a una definici\u00f3n de verificaci\u00f3n y la ejecuci\u00f3n posterior de la suite de pruebas. Este problema ha sido solucionado en la versi\u00f3n 1.0.2b1 de giskard-checks."}], "id": "CVE-2026-40320", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40320", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T13:43:55.511255Z", "version": "2.0.3"}}]}, "published": "2026-04-17T18:16:32.203", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-7xjm-g8f4-rp26"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.2b1)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "giskard-oss", "source": "cna", "vendor": "Giskard-AI"}, "product": "giskard", "vendor": "giskard-ai"}], "analysis": {"en": {"generated_at": "2026-04-18T09:12:46.375519+00:00", "value": {"mitigation_remediation": ["Upgrade Giskard\u2011oss to version 1.0.2b1 or later, where the unsandboxed template rendering is removed.", "Restrict write access to the directory containing check definitions so that only trusted users or processes can modify them.", "Validate or sign check definitions before loading, and only import checks from trusted, authenticated sources."], "summary": {"action": "Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "The affected product is Giskard\u2011AI's open\u2011source framework Giskard\u2011oss. All releases earlier than 1.0.2b1 are vulnerable, because the ConformityCheck class contains the unchecked Jinja2 rendering. Attackers must be able to create or modify check definitions, which are then imported by the test suite as part of normal operation.", "description_and_impact": "The vulnerability stems from Giskard's ConformityCheck class rendering a user-supplied rule string via Jinja2's default Template() constructor without sandboxing. When check definitions are loaded from an untrusted source, a crafted rule string can be interpreted as Jinja2 template code and executed with the process' privileges, allowing an attacker to run arbitrary code. The flaw is a classic unsandboxed template injection, classified as CWE\u20111336. The potential impact is that any code injected through the rule parameter will run during test execution, compromising confidentiality, integrity, and availability of the host system.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate level of severity. No EPSS data is available, and the issue is not listed in CISA's KEV catalog, but the presence of arbitrary code execution makes it a high\u2011risk vector if an attacker can supply a malicious check. Exploitation requires write access to the location where check definitions are stored and subsequent execution of the test suite. Once those prerequisites are met, the attacker can execute arbitrary code with the same privileges as the test runner. The attack vector is inferred to be local to the machine running Giskard, unless the framework accepts externally provided check definitions through a network channel."}}}}, "created": "2026-04-17T20:40:04.460037+00:00", "title": "Unsandboxed Jinja2 Template Rendering in Giskard ConformityCheck", "updated": "2026-04-18T09:15:15.972888+00:00", "vendors": ["giskard-ai", "giskard-ai$PRODUCT$giskard"]}