Binary-husky vulnerabilities
We track 15 vulnerabilities in Binary-husky products across 2 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2025.
Latest Binary-husky vulnerabilities
- 7.5 High severity
gpt_academic: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input{} leads to pa
- 8.8 High severity
binary-husky/gpt_academic: Improper Link Resolution Before File Access
A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploite
- 8.8 High severity
binary-husky/gpt_academic: Path Traversal: '..filename'
A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will
- 8.8 High severity
binary-husky/gpt_academic: Deserialization of Untrusted Data
A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrus
- 7.5 High severity
binary-husky/gpt_academic: Server-Side Request Forgery
In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown翻译中) plugin function, which allows
- 7.5 High severity
binary-husky/gpt_academic: Server-Side Request Forgery
GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the v
- 8.8 High severity
binary-husky/gpt_academic: Improper Link Resolution Before File Access
GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlo
- 7.1 High severity
binary-husky/gpt_academic: Origin Validation Error
GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling
- 8.8 High severity
binary-husky/gpt_academic: Improper Control of Generation of Code
In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allow
- 8.8 High severity
binary-husky/gpt_academic: Improper Control of Generation of Code
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the executi
- 8.8 High severity
binary-husky/gpt_academic: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential sys
- 7.5 High severity
binary-husky/gpt_academic: Allocation of Resources Without Limits or Throttling
A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a multipart boundary during file upload. This results in the server continuously processing each charac
- 7.5 High severity
gpt_academic: Improper Link Resolution Before File Access
GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link fi
- 7.5 High severity
binary-husky/gpt_academic: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host syste
- 9.8 Critical severity
gpt_academic: Deserialization of Untrusted Data
GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that expo