CVE-2023-52311
Command injection in _wget_download which could lead to execute arbitrary commands. The PoC is as follows:
from paddle import utils
utils.download._wget_download("aa; touch codexecution", "bb")We have patched the issue in commit d5550d3f2f5bab48c783b4986ba1cd8e061ce542. The fix will be included in PaddlePaddle 2.6.0.
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
This vulnerability has been reported by huntr.com.