# paddlepaddle (PyPI) vulnerabilities

32 known vulnerabilities (11 critical, 7 high, 14 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/paddlepaddle/

## Advisories (32)

### [CVE-2024-1603](https://cve.now/CVE-2024-1603): confirmed

- Severity: High 8.2
- Published: Mar 23, 2024
- Affected: through 2.6.0.

### [CVE-2024-0818](https://cve.now/CVE-2024-0818): Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6

- Severity: Critical 9.1
- Published: Mar 7, 2024
- Affected: through 2.6.0.

### [CVE-2024-0917](https://cve.now/CVE-2024-0917): remote code execution in paddlepaddle/paddle 2.6.0

- Severity: Critical 9.4
- Published: Mar 7, 2024
- Affected: through 2.6.0.

### [CVE-2024-0815](https://cve.now/CVE-2024-0815): Command injection in paddle.utils.download.\_wget\_download (bypass filter) in paddlepaddle/paddle 2.6.0

- Severity: Critical 9.3
- Published: Mar 7, 2024
- Affected: fixed in 3.0.0-beta0; through 2.6.0.

### [CVE-2024-0817](https://cve.now/CVE-2024-0817): Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0

- Severity: Critical 9.3
- Published: Mar 7, 2024
- Affected: fixed in 3.0.0-beta0; through 2.6.0.

### [CVE-2024-0521](https://cve.now/CVE-2024-0521): Code Injection in paddlepaddle/paddle

- Severity: Critical 9.3
- Published: Jan 20, 2024
- Affected: fixed in 2.6.0.

### [CVE-2023-52314](https://cve.now/CVE-2023-52314): Command injection in convert\_shape\_compare

- Severity: Critical 9.6
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52313](https://cve.now/CVE-2023-52313): FPE in paddle.argmin and paddle.argmax

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52312](https://cve.now/CVE-2023-52312): Null pointer dereference in paddle.crop

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.1; fixed in 2.6.0.

### [CVE-2023-52311](https://cve.now/CVE-2023-52311): Command injection in \_wget\_download

- Severity: Critical 9.6
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52310](https://cve.now/CVE-2023-52310): Command injection in get\_online\_pass\_interval

- Severity: Critical 9.6
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52309](https://cve.now/CVE-2023-52309): Heap buffer overflow in paddle.repeat\_interleave

- Severity: High 8.2
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52308](https://cve.now/CVE-2023-52308): FPE in paddle.amin

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52307](https://cve.now/CVE-2023-52307): Stack overflow in paddle.linalg.lu\_unpack

- Severity: High 8.2
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52306](https://cve.now/CVE-2023-52306): FPE in paddle.lerp

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52305](https://cve.now/CVE-2023-52305): FPE in paddle.topk

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52304](https://cve.now/CVE-2023-52304): Stack overflow in paddle.searchsorted

- Severity: High 8.2
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52303](https://cve.now/CVE-2023-52303): Segfault in paddle.put\_along\_axis

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-52302](https://cve.now/CVE-2023-52302): Segfault in paddle.nextafter

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-38678](https://cve.now/CVE-2023-38678): Segfault in paddle.mode

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-38677](https://cve.now/CVE-2023-38677): FPE in paddle.linalg.eig

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-38676](https://cve.now/CVE-2023-38676): Segfault in paddle.dot

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-38675](https://cve.now/CVE-2023-38675): FPE in paddle.linalg.matrix\_rank

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-38674](https://cve.now/CVE-2023-38674): FPE in paddle.nanmedian

- Severity: Medium 4.7
- Published: Jan 3, 2024
- Affected: fixed in 2.6.0; fixed in 2.6.0.

### [CVE-2023-38673](https://cve.now/CVE-2023-38673): Command injection in fs.py

- Severity: Critical 9.6
- Published: Jul 26, 2023
- Affected: fixed in 2.5.0; fixed in 2.5.0.

### [CVE-2023-38672](https://cve.now/CVE-2023-38672): FPE in paddle.linalg.matrix\_power

- Severity: Medium 4.7
- Published: Jul 26, 2023
- Affected: fixed in 2.5.0; fixed in 2.5.0.

### [CVE-2023-38671](https://cve.now/CVE-2023-38671): Heap buffer overflow in paddle.trace

- Severity: High 8.3
- Published: Jul 26, 2023
- Affected: fixed in 2.5.0; fixed in 2.5.0.

### [CVE-2023-38670](https://cve.now/CVE-2023-38670): Null pointer dereference in paddle.flip

- Severity: Medium 4.7
- Published: Jul 26, 2023
- Affected: fixed in 2.5.0; fixed in 2.5.0.

### [CVE-2023-38669](https://cve.now/CVE-2023-38669): Use after free in paddle.diagonal in PaddlePaddle before 2.5.0.

- Severity: High 8.3
- Published: Jul 26, 2023
- Affected: fixed in 2.5.0; fixed in 2.5.0.

### [CVE-2022-46742](https://cve.now/CVE-2022-46742): Code injection in paddle.audio.functional.get\_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

- Severity: Critical 10.0
- Published: Dec 7, 2022
- Affected: fixed in 2.4.0; fixed in 2.4.0.

### [CVE-2022-46741](https://cve.now/CVE-2022-46741): Out-of-bounds read in gather\_tree in PaddlePaddle before 2.4.

- Severity: High 7.1
- Published: Dec 7, 2022
- Affected: fixed in 2.4.

### [CVE-2022-45908](https://cve.now/CVE-2022-45908): In PaddlePaddle before 2.4, paddle.audio.functional.get\_window is vulnerable to code injection because it calls eval on a user-supplied…

- Severity: Critical 9.8
- Published: Nov 26, 2022
- Affected: fixed in 2.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/paddlepaddle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.