The RegexMatching check in Giskard passes user‑supplied regular expression patterns directly to Python’s re.search without any timeout or complexity guard. A crafted pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. This defect is a classic Regular Expression Denial of Service, identified as CWE‑1333. The impact is a denial of service; it does not expose data or allow code execution but can halt test execution entirely.

All versions of the open‑source Giskard‑OSS framework prior to giskard‑checks 1.0.2b1 are affected. The flaw exists in the RegexMatching component of the Giskard-AI project and would affect any deployment that uses the vulnerable check definition files.

The CVSS score of 1.0 classifies the vulnerability as low severity. EPSS is not available and the issue is not listed in CISA KEV, indicating a relatively low likelihood of widespread exploitation. However, exploitation requires write access to a check definition file and subsequent execution of the test suite, so it is an internal threat that can stall continuous integration pipelines and delay model deployment.