Remote Code Execution Vulnerability in binary-husky/gpt_academic by Binary Husky

CVE-2024-12390

What is CVE-2024-12390?

A vulnerability exists in binary-husky/gpt_academic allowing remote code execution due to inadequate validation when extracting user-provided RAR files. Utilizing the Python rarfile module, an attacker can exploit symlink support to manipulate files. This could potentially allow unauthorized access and modification to sensitive files such as SSH keys, crontab configurations, or the application's source code itself, leading to a severe security breach.

References