PaddlePaddle PaddleX CVE-2026-108961

Exploitation requires the attacker to control the 'scale' argument consumed by NormalizeImage.__init__ in the text_detection Preprocessor - in practice this means getting the victim to load an attacker-supplied PaddleX text-detection model or preprocessing config, since scale is normally a numeric config value passed to the vulnerable eval(). Limiting factors: it is not reachable in a default deployment unless the application ingests untrusted model/pipeline configs; the CVSS vector sets UI:P, indicating victim interaction (loading the malicious model/config) is needed; environments that load only first-party, trusted PaddleX models are not exposed.

This is a CWE-94 code injection caused by PaddleX calling eval() directly on the 'scale' argument in NormalizeImage.__init__ (confirmed by PR #5212, which replaces 'scale = eval(scale)' with a restricted AST-based arithmetic parser). The only input vector is the CVSS 4.0 vector supplied by VulDB (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, base 5.3 Medium); there is no EPSS score, no CISA KEV listing, and no public exploit code referenced. The signals partially conflict: VulDB rates impact as only Low across C/I/A, but eval() of attacker-controlled input is arbitrary Python code execution, which normally warrants High impact - the Low rating appears to understate the technical impact. More importantly, VulDB marks this AV:N/PR:N ('initiate the attack remotely') while the sink is a preprocessing config parameter consumed when a model/pipeline config is loaded, so realistic exploitation depends on the victim loading an attacker-supplied model or config (reflected in UI:P). Net assessment: real but conditional - this is not a drive-by unauthenticated RCE against a default service; it is a code-execution-via-untrusted-model-config flaw. Treat as a priority only for environments that load third-party or user-supplied PaddleX pipelines/models; low urgency where all model configs are trusted. Note the fix PR 'awaits acceptance,' so a merged release patch may not yet be available.

An attacker crafts a malicious PaddleX text-detection model or preprocessing configuration in which the NormalizeImage 'scale' value is a Python expression rather than a number. When a victim loads that pipeline/model, the vulnerable eval(scale) executes the embedded expression as arbitrary Python code in the application's context. No public exploit code is referenced, but the eval() sink is trivial to trigger once scale is attacker-controlled.