CVE-2024-10819
CSRF to XSS in binary-husky/gpt_academic
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CSRF to XSS in binary-husky/gpt_academic
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.
- Record
CVE-2024-10819- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2025-7095
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.
- Record
EUVD-2025-7095- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-29rg-m5qv-57gx
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic...
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.
- Record
GHSA-29rg-m5qv-57gx- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.
- Record
CVE-2024-10819- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
CSRF to XSS in binary-husky/gpt_academic
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.
- Record
CVE-2024-10819- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-10819 is a high vulnerability (CVSS 7.1) in Binary-husky Binary-husky/gpt Academic, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. No source names a fixed version.