{"id":"CVE-2024-52524","aliases":["GHSA-pjwm-cr36-mwv3","PYSEC-2026-1403"],"title":"ReDoS in giskard's transformation.py (GHSL-2024-324)","summary":"ReDoS in giskard's transformation.py (GHSL-2024-324)","severity":"medium","vendor":"giskard","product":"giskard","ecosystem":"pip","affected":["giskard < 2.15.5"],"patched":["giskard 2.15.5"],"published":"2024-11-14","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pjwm-cr36-mwv3","references":[{"url":"https://github.com/Giskard-AI/giskard/security/advisories/GHSA-pjwm-cr36-mwv3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52524"},{"url":"https://github.com/Giskard-AI/giskard/commit/48ce81f5c626171767188d6f0669498fb613b4d3"},{"url":"https://github.com/Giskard-AI/giskard"}],"tags":["osv","pip"],"epss":0.00817,"epssPercentile":0.55319,"ingestedAt":"2026-07-08T18:25:51.788Z","slug":"CVE-2024-52524","body":"## Overview\n\n# ReDoS in Giskard text perturbation detector\n\nA Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the [GitHub Security Lab](https://securitylab.github.com) team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service.\n\n## Details\n\nThe vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection. A regex used to detect URLs and links was vulnerable to catastrophic backtracking that could be triggered by specific patterns in the text.\n\n## Affected version\n\nGiskard versions prior to 2.15.5 are affected. Users should upgrade to version 2.15.5 or later, which includes a fix for this vulnerability.\n\n## Impact\n\nThis vulnerability can cause extended computation times or crashes in Giskard when processing text containing certain patterns.\n\n## Credit\n\nThis issue was discovered and reported by GHSL team member [@kevinbackhouse (Kevin Backhouse)](https://github.com/kevinbackhouse).\n\n## Affected packages\n\n- `giskard < 2.15.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `giskard 2.15.5`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}