LLMHigh
CVE-2024-10950: In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code inj…
- Occurred
- Mar 20, 2025
- Published
- Mar 20, 2025
- Source
- NVD CVE
Summary
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
Tags
- CVE
- CVE-2024-10950
- cvss:HIGH
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Prompt injection vulnerability in LLM plugin allows remote code execution on backend server.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8