Vulnerability in Binary-Husky Binary-Husky/gpt Academic
CVE-2024-10956
GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting conversation history without the victim's consent. The issue arises due to insufficient WebSocket authentication and lack of origin validation.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 25.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Binary-Husky Binary-Husky/gpt Academic — versions unspecified
- Binary-Husky Gpt Academic — versions 3.83
Weakness classification (CWE)
References
- huntr.com/bounties/0f8403ad-5f60-4eb9-9f51-8fbd2e41eda4 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-10956?
- CVE-2024-10956 is a high-severity vulnerability in Binary-Husky Binary-Husky/gpt Academic, classified under Origin Validation Error. CVSS score: 7.1/10. Published 2025-03-20.
- How severe is CVE-2024-10956?
- High severity. CVSS v3 base score is 7.1 out of 10.