CVE-2022-45908: Paddlepaddle

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.

Affected products

• Paddlepaddle Paddlepaddle: before 2.4 (fixed in 2.4)

Published 2022-11-26. Last modified 2026-06-17.