PT-2025-12087 · Unknown · Gpt Academic

Name of the Vulnerable Software and Affected Versions: GPT Academic version 3.83 Description: The issue concerns a Local File Read LFI vulnerability through the HotReload function, which can download and extract tar.gz files from arxiv.org. Despite protections against path traversal, the...

PT-2025-12089 · Hotreload +2 · Hotreload +2

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: A Server-Side Request Forgery SSRF issue exists in the Markdown Translate.get files from everything API, allowing attackers to download arbitrary web hosts by exploiting the HotReload plugin...

CVE-2024-11031: Server-Side Request Forgery (SSRF)

In version 3.83 of binary-husky/gptacademic, a Server-Side Request Forgery SSRF vulnerability exists in the MarkdownTranslate.getfilesfromeverything API. This vulnerability is exploited through the HotReloadMarkdown翻译中 plugin function, which allows downloading arbitrary web hosts by only checking...

CVE-2024-11030: Server-Side Request Forgery (SSRF)

GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery SSRF vulnerability through its HotReload plugin function, which calls the crazyutils.getfilesfromeverything API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic...

CVE-2024-10986: Improper Link Resolution Before File Access

GPT Academic version 3.83 is vulnerable to a Local File Read LFI vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks...

GPT Academic 输入验证错误漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM large language models such as GPT/GLM. A file read vulnerability exists in GPT Academic, which stems from a failure of the HotReload feature to properly validate user input, and can be exploited by an attacker to read...

Malicious code in rollup-plugin-hotreload (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a5f1926b00e34e20d1f36662b0093d46104a516288d7edd6faf52f4ce78a039 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11081 Malicious code in rollup-plugin-hotreload (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a5f1926b00e34e20d1f36662b0093d46104a516288d7edd6faf52f4ce78a039 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...