Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-12390Remote Code Execution in binary-husky/gpt_academic
High 8.8
In plain English
A high-severity security flaw in binary-husky/gpt_academic from binary-husky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Official description
A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's own code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| binary-husky | binary-husky/gpt_academic | unspecified – through latest |
Weakness: CWE-59 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H