CVE-2024-0521: Code Injection in paddlepaddle
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
Published Jan 20, 2024 · Updated Jan 29, 2024
Affected packages
paddlepaddle
- Ecosystem
- PyPI
- Affected
- < 2.6.0
- Fixed in
- 2.6.0
- Check
pip show paddlepaddle
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology