Vulnerability in Binary-Husky Binary-Husky/gpt Academic
CVE-2024-10956
GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting conversation history without the victim's consent. The issue arises due to insufficient WebSocket authentication and lack of origin validation.
EPSS: 0.003 (25.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.
Affected products
- Binary-husky Binary-husky/gpt_academic — versions unspecified
- Binary-husky Gpt_academic — versions 3.83
Weakness classification (CWE)
References
- security@huntr.dev (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-10956?
- CVE-2024-10956 is a high-severity vulnerability in Binary-Husky Binary-Husky/gpt Academic, classified under Origin Validation Error. CVSS score: 7.1/10. Published 2025-03-20.
- How severe is CVE-2024-10956?
- High severity. CVSS v3 base score is 7.1 out of 10.