CVE-2024-11039: Deserialization of Untrusted Data

A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gptacademic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the...

CVE-2024-10956: Origin Validation Error

GPT Academy version 3.83 in the binary-husky/gptacademic repository is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting...

CVE-2024-10819: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in version 3.83 of binary-husky/gptacademic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can...

CVE-2024-11031: Server-Side Request Forgery (SSRF)

In version 3.83 of binary-husky/gptacademic, a Server-Side Request Forgery SSRF vulnerability exists in the MarkdownTranslate.getfilesfromeverything API. This vulnerability is exploited through the HotReloadMarkdown翻译中 plugin function, which allows downloading arbitrary web hosts by only checking...

PT-2025-12133 · Unknown +1 · Binary-Husky/Gpt Academic +1

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version git 310122f Description: A vulnerability in binary-husky/gpt academic allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python...

CVE-2024-10950: Improper Control of Generation of Code

In binary-husky/gptacademic version = 3.83, the plugin CodeInterpreter is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. Th...

PT-2025-12134

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic versions prior to commit 310122f Description A Regular Expression Denial of Service ReDoS issue exists in the 解析项目源码（手动指定和筛选源码文件类型） function. This function allows the execution of user-provided regular expressions...

PT-2025-12130

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic versions as of commit git 3890467 Description A vulnerability in the binary-husky/gpt academic repository allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the...

PT-2025-12091

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic at commit 679352d Description A path traversal issue exists, allowing an attacker to bypass the blocked paths protection and read sensitive information, such as the OpenAI API key, from the config.py file. This issue...

PT-2025-12083

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic versions = 3.83 Description The issue is caused by the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This can be exploite...

PT-2025-12090 · Unknown · Binary-Husky/Gpt Academic

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: A Denial of Service DoS vulnerability exists in the file upload feature due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this b...

CVE-2024-11033: Uncontrolled Resource Consumption

A Denial of Service DoS vulnerability exists in the file upload feature of binary-husky/gptacademic version 3.83. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a payload with an...

PT-2025-12054

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic version 3.83 Description A Denial of Service DoS issue allows an attacker to cause the server to become inaccessible by adding excessive characters to the end of a multipart boundary during file upload. This results i...

PT-2025-12300

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic version 3.9.0 Description A stored cross-site scripting XSS issue exists in the Latex Proof-Reading Module, allowing an attacker to inject malicious scripts into the debug log.html file. When an admin visits this debu...

CVE-2024-10100

A path traversal vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as...

CVE-2024-10101

A stored cross-site scripting XSS vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloa...

CVE-2024-10101 Stored XSS in binary-husky/gpt_academic

A stored cross-site scripting XSS vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloa...

CVE-2024-10101 Stored XSS in binary-husky/gpt_academic

A stored cross-site scripting XSS vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloa...

CVE-2024-10101 Stored XSS in binary-husky/gpt_academic

A stored cross-site scripting XSS vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloa...

CVE-2024-10101

CVE-2024-10101 concerns a stored XSS in binary-husky/gpt_academic v3.83, occurring at the /file endpoint which renders HTML files. Malicious HTML uploads stored on the backend can trigger payload execution in a victim’s browser when the file is accessed, potentially exposing session cookies or ot...