What’s Vulnerable › Vulnerabilities
CVE-2024-12390: Remote Code Execution in binary-husky/gpt_academic
- Severity: high (CVSS 8.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-59
Description
A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's own code.
Affected products
- binary-husky/gpt_academic: 2024-10-15
References
Get alerted when CVE-2024-12390 or the next vulnerability affects your stack