CVE-2023-52311 is a critical severity (9.6) command injection in _wget_download in PaddlePaddle before 2.6.0. It can let an attacker run operating system commands. The fix ships in 2.6.0, so upgrade PaddlePaddle to 2.6.0 or later and never pass untrusted strings to this function.
What's affected
The NVD record names PaddlePaddle, the open source deep learning framework from the PaddlePaddle project, in every release before 2.6.0. The project's own advisory, PDSA-2023-020, says the fix will be included in PaddlePaddle 2.6.0 and points to the commit d5550d3f2f5b.
The weakness classes are CWE-78. The record's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, which gives 9.6 (Critical). The advisory itself does not state a score.
The advisory titles the problem as a command injection in _wget_download. Command injection means a value that should be plain data ends up inside a command that the operating system runs. The advisory calls the result the ability to execute arbitrary commands. The class is CWE-78. The record's vector rates confidentiality, integrity and availability impact all high, with user interaction required.
How to check if you're exposed
Paddle ships on PyPI as the paddlepaddle package, and GPU builds use their own package names, so search for anything containing paddle. In the Python environment where you run the framework:
pip list | grep -i paddle
python -c "import paddle; print(paddle.__version__)"
Any version below 2.6.0 is in the affected range. Check every environment, including virtual environments, notebooks, training servers, containers and CI images, since each one carries its own copy.
To find where the library is pulled in, search your requirements files, pyproject files and lockfiles for paddle. Then ask a second question: does any code path hand untrusted input to _wget_download? The advisory describes the weakness at the level of that one function, so your real exposure depends on whether your application reaches it.
What to do now
- Find every environment that has PaddlePaddle installed, using the commands above.
- Upgrade to 2.6.0 or later, for example with
pip install -U paddlepaddle, then run your tests, since a framework release can change behaviour. - Pin the new version in your requirements file or lockfile so a rebuild does not bring the old one back.
- Until you upgrade, do not pass untrusted values to _wget_download. Treat any string you pass to it as hostile, and keep it out of user reach.
- Rebuild and redeploy container images that bundle the framework, because old layers keep the old library.
Why it matters
Command injection means a value that should be plain data ends up inside a command that the operating system runs. The advisory calls the result the ability to execute arbitrary commands. The class is CWE-78. The record's vector rates confidentiality, integrity and availability impact all high, with user interaction required.
This function lives in tooling around training and data handling more than in the model code itself. Check who controls the arguments, whether that is a config file, a job parameter, or a user. This CVE is one of a group of PaddlePaddle issues disclosed together and fixed in the same release, so the single upgrade covers its siblings. It is not in the CISA Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation in the wild. Safeguard's reachability analysis is built for this question, whether a vulnerable function is actually called by your code. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan.
Quick check
Which PaddlePaddle versions does CVE-2023-52311 affect?
The NVD record and the advisory PDSA-2023-020 say versions before 2.6.0. The fix is included in 2.6.0, so that release or later is the target.
Does CVE-2023-52311 affect my application if I never call _wget_download?
The advisory describes the weakness in that one function, so code that never reaches it is not exposed through this CVE. Confirm by searching your code and your dependencies, and upgrade anyway because the fix is a routine release.
Sources
Last reviewed: 19 October 2026.
