{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.6.0"}],"component":"paddlepaddle","cve_ids":["CVE-2024-0917"],"ecosystem":"PyPI","epss":0.01652,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-mrmm-qmrj-xgp6","id":"tcs_01M5KHBCYGHH5P5N56Q8SXZZAC","modified_at":"2026-07-01T20:22:59.743217Z","published_at":"2026-06-29T11:50:39.027739Z","references":["https://osv.dev/vulnerability/PYSEC-2026-445","https://nvd.nist.gov/vuln/detail/CVE-2024-0917","https://github.com/PaddlePaddle/Paddle","https://github.com/PaddlePaddle/Paddle/blob/develop/python/paddle/distributed/fleet/utils/fs.py#L723","https://huntr.com/bounties/2d840735-e255-4700-9709-6f7361829119","https://pypi.org/project/paddlepaddle","https://github.com/advisories/GHSA-mrmm-qmrj-xgp6"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-445","url":"https://osv.dev/vulnerability/PYSEC-2026-445"}],"summary":"PaddlePaddle vulnerable to remote code execution"}