| Titolo | PaddlePaddle PaddleX up to 3.7.2 (latest release; vulnerable code also confirmed at HEAD commit ffb64904d23708863ff5b8da312a5cbd52a7f462) Code Injection |
|---|
| Descrizione | A vulnerability was found in PaddleX up to 3.7.2 and classified as high 8.8.
Affected is the NormalizeImage preprocessor of the text detection component
(paddlex/inference/models/text_detection/processors.py). The manipulation of the
argument scale, a string field taken from the model directory's inference.yml,
leads to code injection: the value is passed to eval() without validation. It is
possible to launch the attack remotely. User interaction is required: the victim
must obtain and load a crafted model directory, e.g. via `paddleocr text_detection
--model_dir det` (PaddleOCR 3.x, which pins paddlex[ocr-core]>=3.7.0,<3.8.0) or the
PaddleX predictor API. Model weights stay untouched, so weight-level integrity
checks do not notice the manipulation.
Technical Details
- Affected file/function: paddlex/inference/models/text_detection/processors.py,
NormalizeImage.__init__ (lines 241-242: `if isinstance(scale, str): scale = eval(scale)`)
- Vulnerable parameter: PreProcess.transform_ops.NormalizeImage.scale in inference.yml
- Attack vector: Network (model directory distributed over the network)
- Privileges required: None
- Trigger condition: the loading process parses inference.yml and passes the string
scale to NormalizeImage; the crafted expression executes arbitrary Python code and
can return the benign 1./255. value so inference continues without any error or log.
Impact
- Confidentiality: High (arbitrary code execution exposes process memory, files and
credentials of the loading user)
- Integrity: High (arbitrary file write/modification in the user context)
- Availability: High (arbitrary code can crash or take over the process)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-24
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Replace eval() with a restricted parser (an ast-based evaluator allowing only numeric
constants and + - * / operations, keeping backward compatibility with legacy strings
such as "1./255."), and treat inference.yml as untrusted input at the same level as
model weights. |
|---|
| Fonte | ⚠️ https://github.com/PaddlePaddle/PaddleX/issues/5210 |
|---|
| Utente | Dem0 (UID 82596) |
|---|
| Sottomissione | 24/09/2026 18:06 (18 giorni fa) |
|---|
| Moderazione | 11/10/2026 21:30 (17 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 416780 [PaddlePaddle PaddleX fino a 3.7.2 Preprocessor processors.py NormalizeImage.__init__ scale escalationi di privilegi] |
|---|
| Punti | 20 |
|---|