Is CVE-2026-40319 actively exploited?

No active exploitation of CVE-2026-40319 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40319 be exploited remotely?

No. CVE-2026-40319 requires local access to exploit.

What is the CVSS score of CVE-2026-40319?

CVE-2026-40319 has a CVSS score of 1.0 (LOW).

HOME VULNERABILITIESCVE-2026-40319

LOW

CVE-2026-40319

CWE-1333Published: April 17, 2026· Updated: Apr 17, 2026

1.0

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.4th

Official Description

Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.

NVD Source

Technical Analysis

CVE-2026-40319 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionP

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X