PT-2026-53526 · Pypi · Paddlepaddle

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.

Fix

Related Identifiers

PYSEC-2026-444

Affected Products

Paddlepaddle

References · 6

• https://osv.dev/vulnerability/PYSEC-2026-444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0521 · Security Note
• https://github.com/PaddlePaddle/Paddle · Note
• https://github.com/advisories/GHSA-chj7-w3f6-cvfj · Note
• https://pypi.org/project/paddlepaddle · Note
• https://huntr.com/bounties/a569c64b-1e2b-4bed-a19f-47fd5a3da453 · Note