Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by VulDB

CVE-2026-108961PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection

Medium 6.3

In plain English

A medium-severity code injection in PaddleX from PaddlePaddle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 84.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

VendorProductVersions
PaddlePaddle PaddleX 3.7.03.7.13.7.2

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

References