Home » Database

AVID-2026-R1361

Description

Vulnerability CVE-2024-0917

Details

remote code execution in paddlepaddle/paddle 2.6.0

Reason for inclusion in AVID: CVE-2024-0917 describes remote code execution in PaddlePaddle (a major ML framework). This vulnerability affects software used in AI model development, training, and deployment, i.e., general-purpose AI systems. It is in a software component (PaddlePaddle) that AI pipelines rely on, posing a security risk with potential RCE. The report provides explicit CVE reference, affected product, impact details, and CVSS/CWE signals, offering sufficient evidence for curation.

References

Affected or Relevant Artifacts

  • Developer: paddlepaddle
  • Deployer: paddlepaddle
  • Artifact Details:
TypeName
Systempaddlepaddle/paddle

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Base Score9.4
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🟢 Low

CWE

IDDescription
CWE-94CWE-94 Improper Control of Generation of Code

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-03-07
  • Version: 0.3.3
  • AVID Entry