CVE-2024-10954 - CVE House
Back to Database
Status published High CVE-2024-10954

Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`

Vulnerability Description

In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10954

Credits & Attribution

No credits recorded in the NVD database.

References

More from binary-husky

View All →
CVE-2025-25185
GPT Academic allows arbitary file read by tarfile uncompress within softlink
High 7.5
CVE-2025-10236
binary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversal
Medium 5.3
CVE-2025-0183
Stored XSS in binary-husky/gpt_academic
Medium 5.4
CVE-2024-31224
GPT Academic: Pickle deserializing cookies may pose RCE risk
Critical 9.8
CVE-2024-12392
Server-Side Request Forgery (SSRF) in binary-husky/gpt_academic
Medium 6.5

Affected Vendor

binary-husky

View all reports →

Affected Software

binary-husky/gpt_academic
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact