Vulnerability in Binary-Husky Binary-Husky/gpt Academic
CVE-2024-12391
A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The function '解析项目源码（手动指定和筛选源码文件类型）' permits the execution of user-provided regular expressions. Certain regular expressions can cause the Python RE engine to take exponential time to execute, leading to a Denial of Service (DoS) condition. An attacker who controls both the regular expression and the search string can exploit this vulnerability to hang the server for an arbitrary amount of time.
Vulnerability class: ReDoS (Regular Expression Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 59.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.000
Affected products
- Binary-Husky Binary-Husky/gpt Academic — versions unspecified
- Binary-Husky Gpt Academic — versions 2024-10-15
Weakness classification (CWE)
References
- huntr.com/bounties/70b3f4f0-6b1b-4563-a18c-fe46502e6ba0 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-12391?
- CVE-2024-12391 is a medium-severity vulnerability in Binary-Husky Binary-Husky/gpt Academic, classified under Inefficient Regular Expression Complexity. CVSS score: 6.5/10. Published 2025-03-20.
- How severe is CVE-2024-12391?
- Medium severity. CVSS v3 base score is 6.5 out of 10.