In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/9abb1617-0c1d-42c7-a647-d9d2b39c6866 | Exploit Third Party Advisory |
Configurations
History
14 Jul 2025, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/9abb1617-0c1d-42c7-a647-d9d2b39c6866 - Exploit, Third Party Advisory | |
| First Time |
Binary-husky
Binary-husky gpt Academic |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-14 17:20
NVD link : CVE-2024-10950
Mitre link : CVE-2024-10950
JSON object : View
Products Affected
binary-husky
- gpt_academic
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')