CVE-2024-10954 — Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`
In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the ex…
Published: 2025-03-20 · CVSS: 8.8 · CVSS 3.0
In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7