PaddlePaddle vulnerabilities
We track 6 vulnerabilities in PaddlePaddle products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on January 3, 2024.
Latest PaddlePaddle vulnerabilities
- 9.8 Critical severity
PaddlePaddle: Improper Neutralization of Special Elements used in an OS Command
PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.
- 9.8 Critical severity
PaddlePaddle: Improper Neutralization of Special Elements used in an OS Command
PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.
- 9.8 Critical severity
PaddlePaddle: Improper Neutralization of Special Elements used in an OS Command
PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.
- 9.8 Critical severity
PaddlePaddle: Out-of-bounds Write
Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
- 9.8 Critical severity
PaddlePaddle: Out-of-bounds Write
Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
- 9.8 Critical severity
Paddlepaddle: Improper Control of Generation of Code
In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.