GHSA-chj7-w3f6-cvfj
Code Injection in paddlepaddle
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | paddlepaddle | < 2.6.0 | 2.6.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
References
External links from the advisory. They lead to third-party sites.