CVE-2026-40320: Giskard AI Testing Framework RCE Flaw

CVE-2026-40320 Overview

CVE-2026-40320 is a Server-Side Template Injection (SSTI) vulnerability in Giskard, an open-source testing framework designed for AI models. The vulnerability exists in versions prior to 1.0.2b1 where the ConformityCheck class renders the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution on the underlying system.

Critical Impact

Attackers with write access to check definitions can achieve arbitrary code execution by injecting malicious Jinja2 template expressions, potentially compromising the entire AI testing infrastructure.

Affected Products

• Giskard giskard-checks versions prior to 1.0.2b1
• Systems using Giskard AI testing framework with untrusted check definitions
• AI/ML pipelines integrating Giskard conformity checks

Discovery Timeline

• April 17, 2026 - CVE-2026-40320 published to NVD
• April 17, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40320

Vulnerability Analysis

This vulnerability stems from improper neutralization of special elements used in a template engine (CWE-1336). The Giskard testing framework provides a ConformityCheck class that allows users to define validation rules for AI model outputs. The vulnerability occurs because the rule parameter is processed through Jinja2's default Template() constructor without proper sandboxing or input validation.

Jinja2 is a powerful templating engine for Python that, when used with the default Template() constructor, allows execution of arbitrary Python expressions. This means that if an attacker can control the content of a check definition file, they can embed malicious template expressions that will be executed when the test suite runs.

The exploitation chain requires two conditions: first, the attacker must have write access to a check definition (either through direct file access, a compromised CI/CD pipeline, or a supply chain attack), and second, the test suite must be executed to trigger the template rendering. This local attack vector with required user interaction and privileges results in a medium severity classification, though the potential impact includes complete system compromise with high confidentiality, integrity, and availability impacts.

Root Cause

The root cause is the use of Jinja2's unsandboxed Template() constructor to render user-supplied rule parameters. Jinja2's default environment allows access to Python's object introspection capabilities, enabling attackers to traverse the object hierarchy and access dangerous functions. The secure alternative would be to use Jinja2's SandboxedEnvironment or to avoid template rendering entirely for user-supplied input.

Attack Vector

The attack requires local access to modify check definition files or the ability to influence check definitions through other means such as compromised dependencies or malicious pull requests. An attacker would craft a rule string containing Jinja2 template syntax that leverages Python's object introspection to execute system commands. When the test suite runs and the ConformityCheck class processes the malicious rule, the template engine interprets and executes the embedded code.

Common Jinja2 SSTI payloads exploit Python's Method Resolution Order (MRO) to access the subprocess module or os module from base object classes. The attack is particularly dangerous in CI/CD environments where test suites often run with elevated privileges.

Detection Methods for CVE-2026-40320

Indicators of Compromise

• Unusual template syntax in check definition files, particularly containing {{, {%, or __ patterns
• Check definition files with Python object references like __class__, __mro__, __subclasses__, or __globals__
• Unexpected process spawning from Python processes running Giskard test suites
• Anomalous network connections or file access from test execution environments

Detection Strategies

• Implement file integrity monitoring on check definition directories to detect unauthorized modifications
• Scan check definition files for known Jinja2 SSTI payload patterns before execution
• Monitor process creation events from test execution environments for unexpected child processes
• Review CI/CD pipeline logs for unusual test execution patterns or failures

Monitoring Recommendations

• Enable detailed logging for Giskard test suite execution to capture rendered template content
• Set up alerts for modifications to check definition files outside of normal development workflows
• Monitor system call activity during test execution for signs of command injection
• Implement code review requirements for all check definition changes

How to Mitigate CVE-2026-40320

Immediate Actions Required

• Upgrade giskard-checks to version 1.0.2b1 or later immediately
• Audit all existing check definition files for suspicious template expressions
• Restrict write access to check definition directories to trusted personnel only
• Review recent changes to check definitions in version control for malicious content

Patch Information

The vulnerability has been fixed in giskard-checks version 1.0.2b1. The patch addresses the unsafe template rendering by implementing proper input sanitization or sandboxing for the rule parameter in the ConformityCheck class. For detailed information about the fix, refer to the GitHub Release v1.0.2b1 and the GitHub Security Advisory GHSA-7xjm-g8f4-rp26.

Workarounds

• Ensure check definitions are only loaded from trusted, version-controlled sources until upgrade is complete
• Implement pre-execution scanning of check definition files for template injection patterns
• Run test suites in isolated containers with minimal privileges to limit potential impact
• Disable or remove conformity checks that use the vulnerable rule parameter until patched

# Upgrade giskard-checks to the patched version
pip install --upgrade giskard-checks>=1.0.2b1

# Verify installed version
pip show giskard-checks | grep Version