CVE-2024-10950
Code Injection in binary-husky/gpt_academic
概要
Code Injection in binary-husky/gpt_academic
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In binary-husky/gpt_academic version <= 3.83, the plugin CodeInterpreter is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com