GHSA-chj7-w3f6-cvfj

Source

https://github.com/advisories/GHSA-chj7-w3f6-cvfj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-chj7-w3f6-cvfj

Aliases

CVE-2024-0521
PYSEC-2026-444

Published

2024-01-20T21:30:25Z

Modified

2026-09-10T03:50:09Z

Severity

9.3 (Critical) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Code Injection in paddlepaddle

Details

The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.

Database specific

{
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T14:41:50Z",
    "nvd_published_at": "2024-01-20T21:15:43Z",
    "severity": "CRITICAL"
}

References

Affected packages

PyPI / paddlepaddle

Package

Name: paddlepaddle; View open source insights on deps.dev
Purl: pkg:pypi/paddlepaddle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.0

Affected versions

1.*

1.8.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json"