{"data":{"ecosystem":"pypi","name":"giskard-agents","url":"https://aisecwatch.com/packages/pypi/giskard-agents","latestVersion":"1.0.4","firstReleaseAt":"2025-11-04T13:46:22.940Z","repository":null,"llm":{"exposure":"direct","depth":0,"integratedAt":"2025-11-04T13:46:22.940Z","integratedVersion":"0.3.0","sdks":["litellm"],"path":[]},"authority":{"profile":["http"],"fromDependencies":["pypi:httpx"]},"dependencies":[{"ecosystem":"pypi","name":"giskard-llm","versionSpec":"<2,>=1.0.2","scope":"runtime"},{"ecosystem":"pypi","name":"litellm","versionSpec":"<2,>=1.83.0","scope":"extra:litellm"},{"ecosystem":"pypi","name":"giskard-core","versionSpec":"<2,>=1.0.2","scope":"runtime"},{"ecosystem":"pypi","name":"griffe","versionSpec":"<3,>=1.7.0","scope":"runtime"},{"ecosystem":"pypi","name":"httpx","versionSpec":"<1,>=0.28.1","scope":"runtime"},{"ecosystem":"pypi","name":"jinja2","versionSpec":"<4,>=3.1.6","scope":"runtime"},{"ecosystem":"pypi","name":"logfire-api","versionSpec":"<5,>=3.22.0","scope":"runtime"},{"ecosystem":"pypi","name":"numpy","versionSpec":"<3,>=2.4.1","scope":"runtime"},{"ecosystem":"pypi","name":"pydantic","versionSpec":"<3,>=2.11.0","scope":"runtime"},{"ecosystem":"pypi","name":"tenacity","versionSpec":"<10,>=9.1.0","scope":"runtime"},{"ecosystem":"pypi","name":"typing-extensions","versionSpec":"<5,>=4.14.0","scope":"runtime"}],"advisories":[{"id":"db5b7ca6-0269-4452-9cfb-ff186507cc05","url":"https://aisecwatch.com/issues/db5b7ca6-0269-4452-9cfb-ff186507cc05","cveId":"CVE-2026-34172","title":"GHSA-frv4-x25r-588m: Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment","headline":null,"severity":"high","publishedAt":"2026-03-27T22:17:30.000Z","affected":["giskard-agents@>= 1.0.1a1, <= 1.0.2a1 (fixed: 1.0.2b1)","giskard-agents@<= 0.3.3 (fixed: 0.3.4)"],"epssScore":0.0084,"matchedBy":"ecosystem"}],"checkedAt":"2026-10-09T23:02:48.769Z"},"meta":{"advisoryMatching":"by package name and ecosystem; an advisory with no ecosystem recorded for the package is matched by name alone"}}