GHSA-rf7p-79xq-8xwm

PaddlePaddle command injection in _wget_download

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-52311

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	PaddlePaddle	< 2.6.0	2.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-52311 advisory
https://github.com/PaddlePaddle/Paddle/commit/c5f6862d118d7d69210f0e73bea1b055f5f21f2b web
https://github.com/PaddlePaddle/Paddle package
https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-020.md web
https://github.com/pypa/advisory-database/tree/main/vulns/paddlepaddle/PYSEC-2024-143.yaml web