CVE-2023-38673

CriticalCVSS 9.6

Published: 26/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.00%

78th percentile - higher than 78% of all known CVEs

PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.

Exploitation of this vulnerability could lead to full control over the operating system, posing a significant security risk to the organization.

It is recommended to upgrade PaddlePaddle to version 2.5.0 or later to mitigate this vulnerability.

Original NVD description (English source)

PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.