CVE-2024-0815: PaddlePaddle command injection in paddle.utils.download._wget_download

March 7, 2024

Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0

References

github.com/PaddlePaddle/Paddle
github.com/PaddlePaddle/Paddle/commit/4c0888d7b8f10405e2e79adc41c224264f93e816
github.com/advisories/GHSA-qqv2-35q8-p2g2
huntr.com/bounties/83bf8191-b259-4b24-8ec9-0115d7c05350
nvd.nist.gov/vuln/detail/CVE-2024-0815

Detect and mitigate CVE-2024-0815 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →