XSS in Binary-Husky Binary-Husky/gpt Academic
CVE-2024-10101
A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (25.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Binary-husky Binary-husky/gpt_academic — versions unspecified
- Binary-husky Gpt_academic — versions 3.83
Weakness classification (CWE)
References
- security@huntr.dev (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-10101?
- CVE-2024-10101 is a medium-severity vulnerability in Binary-Husky Binary-Husky/gpt Academic, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2024-10-17.
- How severe is CVE-2024-10101?
- Medium severity. CVSS v3 base score is 5.4 out of 10.