CVE Feed

    Dashboard / CVE / CVE-2024-10954

    CVE-2024-10954

    In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.

    Published:Mar 20, 2025
    Last Modified:Oct 15, 2025
    EPS:Mar 20, 2025
    EPSS Score:0.00785
    CVSS Score:8.8

    Affected Products

    Vendor
    Binary-husky
    Product
    Gpt Academic

    Exploits

    https://huntr.com/bounties/72d034e3-6ca2-495d-98a7-ac9565588c09

    Related CVEs

    CVE-2026-0764 (CVSS 9.8) — GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability …
    CVE-2026-0763 (CVSS 9.8) — GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerabil…
    CVE-2026-0762 (CVSS 8.1) — GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2025-10236 (CVSS 2.1) — A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_fil…
    CVE-2024-12387 (CVSS 6.5) — A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to c…
    CVE-2024-10986 (CVSS 8.8) — GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload functio…
    CVE-2024-10950 (CVSS 8.8) — In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection cau…
    CVE-2024-12390 (CVSS 8.8) — A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The applica…
    CVE-2024-10714 (CVSS 7.5) — A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS…
    CVE-2024-12391 (CVSS 6.5) — A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High