Advisoriesby IbisPaddlePaddleGHSA-chj7-w3f6-cvfj
Code Injection in paddlepaddle
Fix: upgrade to 2.6.0 or later
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| paddlepaddle PyPI | < 2.6.0 | 2.6.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2024-0521, PYSEC-2026-444
More PaddlePaddle advisories
All PaddlePaddle
PaddlePaddle floating point exception in paddle.argmin and paddle.argmaxCVE-2023-52313fixed in 2.6.0PaddlePaddle command injection in convert_shape_compareCVE-2023-52314fixed in 2.6.0PaddlePaddle stack overflow in paddle.searchsortedCVE-2023-52304fixed in 2.6.0PaddlePaddle heap buffer overflow in paddle.repeat_interleaveCVE-2023-52309fixed in 2.6.0PaddlePaddle stack overflow in paddle.linalg.lu_unpackCVE-2023-52307fixed in 2.6.0PaddlePaddle command injection in get_online_pass_intervalCVE-2023-52310fixed in 2.6.0