{"id":"CVE-2024-10954","aliases":["EUVD-2025-7051","GHSA-m2gm-4vg9-pcc4"],"status":"published","title":"Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`","description":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01508,"percentile":0.74773,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77","CWE-94"],"published":"2025-03-20T10:10:46Z","modified":"2026-06-17T06:56:46Z","products":[{"vendor":"binary-husky","product":"binary-husky/gpt_academic"},{"vendor":"binary-husky","product":"gpt_academic"}],"references":[{"url":"https://huntr.com/bounties/72d034e3-6ca2-495d-98a7-ac9565588c09","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10954"},{"url":"https://github.com/advisories/GHSA-m2gm-4vg9-pcc4"}],"sources":{"cve":[{"id":"CVE-2024-10954","title":"Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`","description":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.","status":"published","published":"2025-03-20T10:10:46.95Z","modified":"2025-10-15T12:49:27.238Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2025-7051","description":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.","status":"published","published":"2025-03-20T10:10:46Z","modified":"2025-10-15T12:49:27Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:32.493073Z"}],"ghsa":[{"id":"GHSA-m2gm-4vg9-pcc4","title":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability...","description":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.","status":"published","published":"2025-03-20T12:32:41Z","modified":"2025-10-15T15:31:26Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-94"],"updated_at":"2026-11-02T15:03:59.559504Z"}],"nvd":[{"id":"CVE-2024-10954","description":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.","status":"published","published":"2025-03-20T10:15:22.23Z","modified":"2026-06-17T06:56:46.14Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:45.815983Z"}]}}