CVE-2024-10950 — Code Injection in binary-husky/gpt_academic
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-pr…
Published: 2025-03-20 · CVSS: 8.8 · CVSS 3.0
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7