{"id":"CVE-2024-0817","aliases":["GHSA-fh54-3vhg-mpc2","PYSEC-2026-1754"],"title":"PaddlePaddle command injection vulnerability","summary":"PaddlePaddle command injection vulnerability","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"paddlepaddle","product":"paddlepaddle","ecosystem":"pip","affected":["paddlepaddle <= 2.6.0"],"published":"2024-03-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:10.451888082Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fh54-3vhg-mpc2","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0817"},{"url":"https://github.com/PaddlePaddle/Paddle/commit/bdf6234fdc22e6ee7948950d271cbbe1d27edc93"},{"url":"https://github.com/PaddlePaddle/Paddle"},{"url":"https://huntr.com/bounties/44d5cbd9-a046-417b-a8d4-bea6fda9cbe3"}],"tags":["osv","pip"],"epss":0.01166,"epssPercentile":0.65468,"ingestedAt":"2026-07-08T18:25:48.906Z","slug":"CVE-2024-0817","body":"## Overview\n\nCommand injection in IrGraph.draw in paddlepaddle/paddle 2.6.0\n\n## Affected packages\n\n- `paddlepaddle <= 2.6.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}