Vulnerability Details CVE-2024-10950
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.7%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2024-10950
-
cpe:2.3:a:binary-husky:gpt_academic:2.4
-
cpe:2.3:a:binary-husky:gpt_academic:2.5
-
cpe:2.3:a:binary-husky:gpt_academic:2.67
-
cpe:2.3:a:binary-husky:gpt_academic:2.68
-
cpe:2.3:a:binary-husky:gpt_academic:2.68-2
-
cpe:2.3:a:binary-husky:gpt_academic:2.68-3
-
cpe:2.3:a:binary-husky:gpt_academic:2.68-4
-
cpe:2.3:a:binary-husky:gpt_academic:2.7
-
cpe:2.3:a:binary-husky:gpt_academic:3.1
-
cpe:2.3:a:binary-husky:gpt_academic:3.1-2
-
cpe:2.3:a:binary-husky:gpt_academic:3.1-3
-
cpe:2.3:a:binary-husky:gpt_academic:3.15
-
cpe:2.3:a:binary-husky:gpt_academic:3.2
-
cpe:2.3:a:binary-husky:gpt_academic:3.3
-
cpe:2.3:a:binary-husky:gpt_academic:3.3-2
-
cpe:2.3:a:binary-husky:gpt_academic:3.3-3
-
cpe:2.3:a:binary-husky:gpt_academic:3.3-4
-
cpe:2.3:a:binary-husky:gpt_academic:3.32
-
cpe:2.3:a:binary-husky:gpt_academic:3.33
-
cpe:2.3:a:binary-husky:gpt_academic:3.33-2
-
cpe:2.3:a:binary-husky:gpt_academic:3.34
-
cpe:2.3:a:binary-husky:gpt_academic:3.35
-
cpe:2.3:a:binary-husky:gpt_academic:3.36
-
cpe:2.3:a:binary-husky:gpt_academic:3.37
-
cpe:2.3:a:binary-husky:gpt_academic:3.37-2
-
cpe:2.3:a:binary-husky:gpt_academic:3.37-3
-
cpe:2.3:a:binary-husky:gpt_academic:3.37-4