The vulnerability (CVE-2026-40320) in giskard-oss before version 1.0.2b1 involves improper neutralization of special elements used in a template engine (CWE-1336). Specifically, the ConformityCheck class renders the rule parameter using Jinja2's default Template() constructor, which evaluates template expressions at runtime without sanitization. If an attacker can write a malicious rule string into a check definition and trigger execution of the test suite, they can execute arbitrary code. This requires both write access to the check definitions and the ability to run the tests. The vulnerability is resolved in giskard-checks version 1.0.2b1.

Successful exploitation allows an attacker with limited privileges (write access to check definitions and permission to execute the test suite) to achieve arbitrary code execution within the context of the giskard-oss application. This could lead to unauthorized actions or compromise of the host environment running the tests. The CVSS 4.0 base score is 5.4, indicating a medium severity impact.

A fix is available in giskard-checks version 1.0.2b1. Users should upgrade to this version or later to remediate the vulnerability. Since the vulnerability requires write access to check definitions and execution of the test suite, restricting these permissions can also reduce risk. Patch status is not explicitly stated in the vendor advisory content, but the description confirms the issue is fixed in version 1.0.2b1.