CVE-2024-0815: PaddlePaddle command injection in paddle.utils.download._wget_download

March 7, 2024 (updated January 21, 2025)

Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0

References

github.com/PaddlePaddle/Paddle
github.com/PaddlePaddle/Paddle/commit/4c0888d7b8f10405e2e79adc41c224264f93e816
github.com/advisories/GHSA-qqv2-35q8-p2g2
huntr.com/bounties/83bf8191-b259-4b24-8ec9-0115d7c05350
nvd.nist.gov/vuln/detail/CVE-2024-0815

Code Behaviors & Features

Detect and mitigate CVE-2024-0815 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →