Vulnerability Description
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Binary-Husky | Gpt Academic | <= 3.83 |
Related Weaknesses (CWE)
References
- https://huntr.com/bounties/9abb1617-0c1d-42c7-a647-d9d2b39c6866ExploitThird Party Advisory
FAQ
What is CVE-2024-10950?
CVE-2024-10950 is a vulnerability with a CVSS score of 8.8 (HIGH). In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that gen...
How severe is CVE-2024-10950?
CVE-2024-10950 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-10950?
Check the references section above for vendor advisories and patch information. Affected products include: Binary-Husky Gpt Academic.