GHSA-3cr5-2446-8pg3

PaddlePaddle command injection in convert_shape_compare

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-52314

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	PaddlePaddle	< 2.6.0	2.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-52314 advisory
https://github.com/PaddlePaddle/Paddle/commit/5ed9478fdef96a06eeec9093f9e768c97b094af3 web
https://github.com/PaddlePaddle/Paddle package
https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-023.md web
https://github.com/pypa/advisory-database/tree/main/vulns/paddlepaddle/PYSEC-2024-146.yaml web