PyPI/paddlepaddle CVE-2024-0815: high 8.8, EPSS 1.13%

PaddlePaddle command injection in paddle.utils.download._wget_download

Action: Upgrade paddlepaddle to 3.0.0-beta0 or later.

pip install paddlepaddle==3.0.0-beta0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1756
• https://nvd.nist.gov/vuln/detail/CVE-2024-0815
• https://github.com/PaddlePaddle/Paddle/commit/4c0888d7b8f10405e2e79adc41c224264f93e816
• https://github.com/PaddlePaddle/Paddle
• https://huntr.com/bounties/83bf8191-b259-4b24-8ec9-0115d7c05350
• https://pypi.org/project/paddlepaddle
• https://github.com/advisories/GHSA-qqv2-35q8-p2g2

CVE-2024-0815 · published 2026-07-07T11:45:34.575359Z · modified 2026-07-07T17:47:47.644600679Z · JSON