The vulnerability in giskard-oss before version 1.0.2b1 arises from the RegexMatching check passing user-supplied regular expressions directly to Python's re.search() function without any safeguards against complex patterns that can cause catastrophic backtracking. This can lead to the process hanging indefinitely when processing malicious regex patterns. Exploitation requires an attacker to have write access to a check definition and then execute the test suite. The issue is addressed in giskard-checks version 1.0.2b1.

An attacker with write access to check definitions can supply crafted regex patterns that cause the test suite process to hang indefinitely due to catastrophic backtracking. This results in a denial of service condition affecting the availability of the testing framework during execution. There is no indication of confidentiality, integrity, or broader system impact. No known exploits are reported in the wild.

Upgrade giskard-oss to version 1.0.2b1 or later, where this issue is fixed. Since the vulnerability requires write access to check definitions, restricting write permissions to trusted users also mitigates risk. Patch status is confirmed fixed in version 1.0.2b1. No additional vendor advisory is provided, so check official Giskard-AI resources for updates.