In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/72d034e3-6ca2-495d-98a7-ac9565588c09 | Exploit Third Party Advisory |
Configurations
History
31 Jul 2025, 15:00
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Binary-husky
Binary-husky gpt Academic |
|
| CPE | cpe:2.3:a:binary-husky:gpt_academic:-:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/72d034e3-6ca2-495d-98a7-ac9565588c09 - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-31 15:00
NVD link : CVE-2024-10954
Mitre link : CVE-2024-10954
JSON object : View
Products Affected
binary-husky
- gpt_academic
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')