CVE-2023-52311: 
Python vulnerability analysis and mitigation

PaddlePaddle before version 2.6.0 contains a command injection vulnerability (CVE-2023-52311) in the _wget_download function. The vulnerability was discovered and reported through huntr.com, with the initial disclosure made on January 3, 2024 (NVD, Vendor Advisory).

The vulnerability is classified as a Command Injection (CWE-78) with a CVSS v3.1 base score of 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) according to NIST's assessment. The issue specifically exists in the _wget_download function where user input is not properly sanitized before being used in system commands (NVD).

The vulnerability allows attackers to execute arbitrary commands on the operating system through the _wget_download function. This results in complete compromise of system confidentiality, integrity, and availability (NVD).

A proof of concept exploit has been documented that demonstrates the vulnerability can be triggered using simple Python code: 'from paddle import utils; utils.download._wget_download("aa; touch codexecution", "bb")' (Vendor Advisory).

The vulnerability has been patched in PaddlePaddle version 2.6.0. The fix was implemented in commit d5550d3f2f5bab48c783b4986ba1cd8e061ce542 (Vendor Advisory).