CVE-2026-108961

medium

Description

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

References

https://vuldb.com/vuln/416780/cti

https://vuldb.com/vuln/416780

https://vuldb.com/submit/997956

https://vuldb.com/cve/CVE-2026-108961

https://github.com/PaddlePaddle/PaddleX/pull/5212

https://github.com/PaddlePaddle/PaddleX/issues/5210

https://github.com/PaddlePaddle/PaddleX/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98276

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-15

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00244