CVE-2024-12390: falha de alta gravidade em binary-husky/gpt_academic
Remote Code Execution in binary-husky/gpt_academic
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 1.7%
A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's own code.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
binary-husky · binary-husky/gpt_academicCVEs relacionadas — binary-husky/gpt_academic
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11039HIGHDeserialization of Untrusted Data in binary-husky/gpt_academicEPSS 2.1%CVE-2024-12389HIGHPath Traversal in binary-husky/gpt_academicEPSS 1.7%CVE-2024-10954HIGHPrompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`EPSS 1.5%CVE-2024-10950HIGHCode Injection in binary-husky/gpt_academicEPSS 1.5%CVE-2024-11037MEDIUMPath Traversal in binary-husky/gpt_academicEPSS 1.1%CVE-2024-12391MEDIUMRegular Expression Denial of Service (ReDoS) in binary-husky/gpt_academicEPSS 0.9%