Remote Command Execution Vulnerability in Binary-Husky's gpt_academic Plugin

CVE-2024-11039

What is CVE-2024-11039?

A vulnerability in the Latex English error correction function of the gpt_academic plugin allows attackers to exploit pickle deserialization. By leveraging the inclusion of numpy in the deserialization whitelist, attackers can craft a malicious compressed package containing specific files that, when deserialized, enable remote command execution. This poses a significant risk, particularly when untrusted data is processed. The issue has been addressed in a recent commit.

References