Code Injection Vulnerability in PaddlePaddle PaddleX Preprocessor
CVE-2026-108961

5.3MEDIUM

Key Information:

Vendor

Paddlepaddle

Status
Paddlex
Vendor
CVE Published:
13 October 2026

What is CVE-2026-108961?

A code injection vulnerability was identified in the PaddleX Preprocessor component's NormalizeImage.init function, located in paddlex/inference/models/text_detection/processors.py. This flaw arises from improper handling of the scale argument, allowing an attacker to execute arbitrary code remotely. Remediation efforts are in progress, but prospective users should be aware of the risks posed by this vulnerability.

Affected Version(s)

PaddleX 3.7.0

PaddleX 3.7.1

PaddleX 3.7.2

References

https://vuldb.com/vuln/416780
vdb-entrytechnical-description
https://vuldb.com/vuln/416780/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108961
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dem0 (VulDB User)
VulDB CNA Team
.