CVE-2024-11039 Details
Description
A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b.
A pickle deserialization vulnerability has been identified in the Binary-Husky GPT Academic LaTeX English error correction plugin, affecting versions through 3.83. This vulnerability allows remote command execution by deserializing untrusted data. The issue stems from numpy being included in the deserialization whitelist, which can be exploited by creating a malicious compressed package with a crafted merge_result.pkl file and a corresponding LaTeX file. The vulnerability is present because the plugin's deserialization function did not adequately restrict which classes could be safely deserialized, allowing for the execution of arbitrary commands by exploiting the deserialization of a specially crafted numpy object.
Users can update to Binary-Husky GPT Academic version 3.91 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb | [email protected] | Patch |
| https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| binary-husky gpt academic | < 3.91 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2025 | Initial Analysis | [email protected] |
| Mar 20, 2025 | New CVE Received | [email protected] |