CVE-2024-10950
Code Injection in binary-husky/gpt_academic
Summary
Code Injection in binary-husky/gpt_academic
Original description
The description as published by the source.
In binary-husky/gpt_academic version <= 3.83, the plugin CodeInterpreter is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
References
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com