GitHub Advisoryadvisory · PyPI

GHSA-chj7-w3f6-cvfj Code Injection in paddlepaddle

CRITICAL Published 2024-01-20 Modified 2024-01-29 Official page ↗
Aliases
CVE-2024-0521
Ecosystem
PyPI
Packages
paddlepaddle
Severity
Critical
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-01-23

Affected packages

• PyPI paddlepaddle: < 2.6.0 → fixed in 2.6.0

Description

The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.

Related

Alias · CVE (1)

  • CVE-2024-0521 Code Injection in paddlepaddle/paddle vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References