A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb | Patch |
| https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5 | Exploit Third Party Advisory |
Configurations
History
14 Jul 2025, 14:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5 - Exploit, Third Party Advisory | |
| References | () https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb - Patch | |
| First Time |
Binary-husky
Binary-husky gpt Academic |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-14 14:24
NVD link : CVE-2024-11039
Mitre link : CVE-2024-11039
JSON object : View
Products Affected
binary-husky
- gpt_academic
CWE
CWE-502
Deserialization of Untrusted Data