CVE-2024-52524

Name of the Vulnerable Software and Affected Versions Giskard versions prior to 2.15.5

Description A Remote Code Execution (ReDoS) vulnerability was discovered in the Giskard component. This issue can trigger exponential regex evaluation times when processing datasets with specific text patterns, potentially leading to denial of service. The vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection, where a regex used to detect URLs and links is vulnerable to catastrophic backtracking.

Recommendations For Giskard versions prior to 2.15.5, upgrade to version 2.15.5 or later, which includes a fix for this vulnerability. As a temporary workaround, consider restricting the use of the text perturbation detection feature until the issue is resolved. Avoid using the vulnerable regex pattern in the text perturbation detector to minimize the risk of exploitation.