| Package | Affected versions | Patched versions |
|---|---|---|
| gpt academic | ≤ 3.83 |
In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. This vulnerability can be exploited by an attacker to achieve remote code execution (RCE) on the application backend server, potentially gaining full control of the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free