CVE-2024-10950

NONE EPSS 68.0%

Published Mar 20, 20251y ago · Modified Jun 17, 20261w ago

Published Mar 20, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.

Threat Intelligence

EPSS Exploit Probability

68.0% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-94 Improper Control of Generation of Code (Code Injection) Injection

Affected Products 1

Vendor	Product	Version	Range
binary-husky	gpt_academic	*	≤3.83

References 1

huntr.com https://huntr.com/bounties/9abb1617-0c1d-42c7-a647-d9d2b39c6866

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.