{"id":"CVE-2026-40320","aliases":["EUVD-2026-24060","GHSA-7xjm-g8f4-rp26","PYSEC-2026-2488"],"status":"published","title":"Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck","description":"Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00144,"percentile":0.03713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1336"],"published":"2026-04-14T23:13:52Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"PyPI","package":"giskard-checks","fixed_in":["1.0.2b1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"giskard-checks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.1b1"},{"fixed":"1.0.2b1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"giskard-checks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2b1"}]}],"versions":["1.0.1a1","1.0.1a2","1.0.1b1"]},{"source":"osv","ecosystem":"PyPI","package":"giskard-checks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2b1"}]}],"versions":["1.0.1a1","1.0.1a2","1.0.1b1"]}],"products":[{"vendor":"giskard","product":"giskard"},{"vendor":"giskard-ai","product":"giskard-oss"}],"references":[{"url":"https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-7xjm-g8f4-rp26","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Giskard-AI/giskard-oss/releases/tag/giskard-checks%2Fv1.0.2b1","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40320","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7xjm-g8f4-rp26","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40320.json","tags":["advisory"]},{"url":"https://github.com/Giskard-AI/giskard-oss","tags":["package"]},{"url":"https://pypi.org/project/giskard-checks","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40320","title":"Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck","description":"Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.","status":"published","published":"2026-04-17T17:25:50.449Z","modified":"2026-04-20T13:46:09.036Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-24060","description":"Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.","status":"published","published":"2026-04-17T17:25:50Z","modified":"2026-04-20T13:46:09Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium"}],"updated_at":"2026-11-02T19:24:22.924744Z"}],"ghsa":[{"id":"GHSA-7xjm-g8f4-rp26","title":"Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck","description":"## Summary\n \nThe `ConformityCheck` class in `giskard-checks` rendered the `rule` parameter through Jinja2's default `Template()` constructor. Because the `rule` string is silently interpreted as a Jinja2 template, a developer may not realize that template expressions embedded in rule definitions are evaluated at runtime. In a scenario where check definitions are loaded from an untrusted source (e.g. a shared project file or externally contributed configuration), this could lead to arbitrary code execution.\n\n`giskard-checks` is a local developer testing library with no network-facing service. Check definitions, including the `rule` parameter, are provided in application code or project configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite by a developer.\n\nHowever, the implicit template evaluation of the `rule` parameter is not obvious from the API surface. This hidden behavior increases the likelihood of a developer inadvertently passing untrusted input to it when integrating the library into a larger system. \n\n## Affected Component\n \n`conformity.py`, line 59:\n```python\nfrom jinja2 import Template\n...\nformatted_rule = Template(self.rule).render(trace=trace)\n```\n \n## Affected Versions\n \n`giskard-checks` \u003c 1.0.2b1\n \n## Patched Version\n \n`giskard-checks` \u003e= **1.0.2b1** (template parsing removed from rule evaluation entirely)\n \n## Remediation\n \nUpgrade to `giskard-checks` \u003e= 1.0.2b1. The template rendering has been removed from rule evaluation.\n \n## Credit\n \nGiskard-AI thanks @dhabaleshwar for identifying the unsandboxed template usage.","status":"published","published":"2026-04-14T23:13:52Z","modified":"2026-04-27T15:02:34Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:39:58.897998Z"}],"nvd":[{"id":"CVE-2026-40320","description":"Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.","status":"published","published":"2026-04-17T18:16:32.203Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"CVE-2026-40320","title":"Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck","description":"Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.","status":"published","published":"2026-04-17T17:25:50.449Z","modified":"2026-10-28T02:31:09.035695226Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-7xjm-g8f4-rp26","title":"Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck","description":"## Summary\n \nThe `ConformityCheck` class in `giskard-checks` rendered the `rule` parameter through Jinja2's default `Template()` constructor. Because the `rule` string is silently interpreted as a Jinja2 template, a developer may not realize that template expressions embedded in rule definitions are evaluated at runtime. In a scenario where check definitions are loaded from an untrusted source (e.g. a shared project file or externally contributed configuration), this could lead to arbitrary code execution.\n\n`giskard-checks` is a local developer testing library with no network-facing service. Check definitions, including the `rule` parameter, are provided in application code or project configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite by a developer.\n\nHowever, the implicit template evaluation of the `rule` parameter is not obvious from the API surface. This hidden behavior increases the likelihood of a developer inadvertently passing untrusted input to it when integrating the library into a larger system. \n\n## Affected Component\n \n`conformity.py`, line 59:\n```python\nfrom jinja2 import Template\n...\nformatted_rule = Template(self.rule).render(trace=trace)\n```\n \n## Affected Versions\n \n`giskard-checks` \u003c 1.0.2b1\n \n## Patched Version\n \n`giskard-checks` \u003e= **1.0.2b1** (template parsing removed from rule evaluation entirely)\n \n## Remediation\n \nUpgrade to `giskard-checks` \u003e= 1.0.2b1. The template rendering has been removed from rule evaluation.\n \n## Credit\n \nGiskard-AI thanks @dhabaleshwar for identifying the unsandboxed template usage.","status":"published","published":"2026-04-14T23:13:52Z","modified":"2026-07-13T16:43:42.102045575Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"PYSEC-2026-2488","title":"Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck","description":"## Summary\n \nThe `ConformityCheck` class in `giskard-checks` rendered the `rule` parameter through Jinja2's default `Template()` constructor. Because the `rule` string is silently interpreted as a Jinja2 template, a developer may not realize that template expressions embedded in rule definitions are evaluated at runtime. In a scenario where check definitions are loaded from an untrusted source (e.g. a shared project file or externally contributed configuration), this could lead to arbitrary code execution.\n\n`giskard-checks` is a local developer testing library with no network-facing service. Check definitions, including the `rule` parameter, are provided in application code or project configuration files and executed locally. Exploitation requires write access to a check definition and subsequent execution of the test suite by a developer.\n\nHowever, the implicit template evaluation of the `rule` parameter is not obvious from the API surface. This hidden behavior increases the likelihood of a developer inadvertently passing untrusted input to it when integrating the library into a larger system. \n\n## Affected Component\n \n`conformity.py`, line 59:\n```python\nfrom jinja2 import Template\n...\nformatted_rule = Template(self.rule).render(trace=trace)\n```\n \n## Affected Versions\n \n`giskard-checks` \u003c 1.0.2b1\n \n## Patched Version\n \n`giskard-checks` \u003e= **1.0.2b1** (template parsing removed from rule evaluation entirely)\n \n## Remediation\n \nUpgrade to `giskard-checks` \u003e= 1.0.2b1. The template rendering has been removed from rule evaluation.\n \n## Credit\n \nGiskard-AI thanks @dhabaleshwar for identifying the unsandboxed template usage.","status":"published","published":"2026-07-13T15:02:47.672303Z","modified":"2026-07-13T16:32:37.390646608Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}