A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information.

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00197.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Binary-husky
  • Gpt Academic

Configuration 1 [-]

cpe:2.3:a:binary-husky:gpt_academic:3.83:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-33574 A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://huntr.com/bounties/0436d96a-a2c4-4ca5-9f3c-fd68eb74d2cb cve-icon cve-icon
History

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00147}

 epss

{'score': 0.00164}

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00126}

 epss

{'score': 0.00147}

Fri, 11 Jul 2025 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:binary-husky:gpt_academic:3.83:*:*:*:*:*:*:*

Fri, 20 Dec 2024 21:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_0

{'score': 7.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'}

 cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Mon, 04 Nov 2024 18:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_0

{'score': 8.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'}

 cvssV3_0

{'score': 7.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'}

Thu, 17 Oct 2024 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Binary-husky
Binary-husky gpt Academic
CPEs cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:*
Vendors & Products Binary-husky
Binary-husky gpt Academic
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Oct 2024 18:30:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information.
Title Stored XSS in binary-husky/gpt_academic
Weaknesses CWE-79
References
Metrics cvssV3_0

{'score': 8.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2024-12-20T20:53:16.445Z

Reserved: 2024-10-17T17:38:16.094Z

Link: CVE-2024-10101

cve-icon Vulnrichment

Updated: 2024-10-17T19:24:16.844Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-17T19:15:21.713

Modified: 2025-07-11T20:44:32.730

Link: CVE-2024-10101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.