{"id":"CVE-2024-0521","aliases":["GHSA-chj7-w3f6-cvfj","PYSEC-2026-444"],"title":"Code Injection in paddlepaddle","summary":"Code Injection in paddlepaddle","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendor":"paddlepaddle","product":"paddlepaddle","ecosystem":"pip","affected":["paddlepaddle < 2.6.0"],"patched":["paddlepaddle 2.6.0"],"published":"2024-01-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:09.356827059Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-chj7-w3f6-cvfj","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0521"},{"url":"https://github.com/PaddlePaddle/Paddle"},{"url":"https://huntr.com/bounties/a569c64b-1e2b-4bed-a19f-47fd5a3da453"}],"tags":["osv","pip"],"epss":0.0046,"epssPercentile":0.37121,"ingestedAt":"2026-09-12T03:13:01.688Z","slug":"CVE-2024-0521","body":"## Overview\n\nThe vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.\n\n## Affected packages\n\n- `paddlepaddle < 2.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `paddlepaddle 2.6.0`","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}