CVE-2026-108961

MEDIUM 6.3

PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.init code injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

CWE	CWE-94 CWE-74
Vendor	paddlepaddle
Product	paddlex
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for paddlepaddle paddlex

Be the first to know when new medium vulnerabilities affecting paddlepaddle paddlex are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

PaddlePaddle / PaddleX

3.7.0 3.7.1 3.7.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416780 vuldb.com: https://vuldb.com/vuln/416780/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108961 vuldb.com: https://vuldb.com/submit/997956 github.com: https://github.com/PaddlePaddle/PaddleX/issues/5210 github.com: https://github.com/PaddlePaddle/PaddleX/pull/5212 github.com: https://github.com/PaddlePaddle/PaddleX/

Credits

🔍 Dem0 (VulDB User) VulDB CNA Team