-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly states that the 'url' parameter is incorporated into a command string without validation. In Python ecosystems, functions handling downloads (like get_path_from_url) commonly use shell commands for fetching resources. The function name and file path are inferred from standard PaddlePaddle utility modules, which align with the described injection vector. The high confidence stems from the direct match between the described vulnerability pattern (CWE-94) and typical unsafe subprocess/shell command usage with URL parameters.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paddlepaddle | pip | < 2.6.0 | 2.6.0 |