CVE-2024-10950
Code Injection in binary-husky/gpt_academic
Résumé
Code Injection in binary-husky/gpt_academic
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In binary-husky/gpt_academic version <= 3.83, the plugin CodeInterpreter is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
Références
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com