CVE-2024-0521
Code Injection in paddlepaddle
9.3
CRITICAL
CVSS 3.1
EPSS 0.10%
Description
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
How to fix CVE-2024-0521
To remediate CVE-2024-0521, upgrade the affected package to a fixed version below.
- PyPI/paddlepaddle—upgrade to 2.6.0 or later
Is CVE-2024-0521 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2.6.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.3 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |