Summaryinfo

A vulnerability identified as critical has been detected in Giskard-AI giskard-oss up to 0.3.3/1.0.2. This issue affects the function ChatWorkflow.chat of the component Name Message Handler. This manipulation causes improper neutralization of special elements used in a template engine. This vulnerability is handled as CVE-2026-34172. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Giskard-AI giskard-oss up to 0.3.3/1.0.2. It has been declared as critical. Affected by this vulnerability is the function ChatWorkflow.chat of the component Name Message Handler. The manipulation with an unknown input leads to a improper neutralization of special elements used in a template engine vulnerability. The CWE definition for the vulnerability is CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-34172 since 03/25/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1221 according to MITRE ATT&CK.

Upgrading to version 0.3.4 or 1.0.2b1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Giskard-AI

Name

• giskard-oss

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 1.0.0
• 1.0.1
• 1.0.2

Website

• Product: https://github.com/Giskard-AI/giskard-oss/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion