CVE-2024-0815 is a high severity (CVSS 8.8) OS command injection in PaddlePaddle 2.6.0, in paddle.utils.download._wget_download, where a filter can be bypassed. The record gives no fixed version. Upgrade to the newest release, avoid passing untrusted URLs to the helper, and check the project advisory.
What's affected
PaddlePaddle 2.6.0, in the function paddle.utils.download._wget_download. The record says it is a command injection where a filter can be bypassed. The reference is a huntr bounty page, and no fixed version is named.
Check the project's release notes for the first release after 2.6.0 that addresses the issue before you rely on an upgrade.
The record classifies the weakness as CWE-78 (OS command injection). NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
How to check if you're exposed
Check which version of the package is installed in each environment, including virtual environments, notebooks and container images:
pip show paddlepaddle
pip list --format=freeze | grep -i paddle
Search your repositories for requirement files and lock files that pin the package. A pinned version in a lock file is what actually ships, so read that rather than the loose range in a requirements file. The free in-browser dependency scan can do this for a repository and flag known advisories for the packages it finds.
What to do now
- Find every environment with paddlepaddle 2.6.0, including notebooks and training images.
- Upgrade to the latest release and read the release notes for download helper changes.
- Do not pass user supplied URLs or filenames to paddle.utils.download. Validate them against an allow list in your own code first.
- Run model download and training jobs under accounts with narrow file and network access.
Why it matters
Command injection (CWE-78) happens when text from a caller becomes part of a shell command. The helper builds a wget call, and the record says a filter meant to prevent this can be bypassed.
Machine learning code often runs with broad access to data and credentials, so a command injection in a utility function can matter more than its single call site suggests. Reachability analysis helps show whether your code can pass attacker influenced input to it.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Not every vulnerable function is called by your code. This demo shows how reachability analysis separates reachable findings from the rest.
Click through it at your own pace, or open it full screen.
Quick check
Is my code exposed if I never call this function?
Probably not directly, but libraries can call it internally. Reachability analysis or a code search tells you for certain.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
