CVE-2024-10950: GPT Academic CodeInterpreter RCE Flaw

CVE-2024-10950 Overview

CVE-2024-10950 is a code injection vulnerability in the CodeInterpreter plugin of binary-husky/gpt_academic through version 3.83. The application executes large language model (LLM) generated code from user-supplied prompts without sandboxing. An authenticated attacker can craft a prompt that steers the LLM into producing malicious Python code, which the backend then executes. Successful exploitation yields remote code execution (RCE) on the application server. The flaw maps to CWE-94: Improper Control of Generation of Code.

Critical Impact
An authenticated attacker can achieve remote code execution on the gpt_academic backend, potentially gaining full control of the host running the application.

Affected Products

binary-husky/gpt_academic versions <= 3.83
The CodeInterpreter plugin component
Deployments exposing the plugin to untrusted users

Discovery Timeline

2025-03-20 - CVE-2024-10950 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10950

Vulnerability Analysis

The CodeInterpreter plugin in gpt_academic accepts natural language prompts, forwards them to an LLM, and executes returned code fragments on the backend. The execution path lacks a sandbox, syntactic allowlist, or resource isolation. Because the LLM output is directly influenced by attacker-controlled prompt text, an attacker can perform prompt injection to shape the generated code. When the generated Python is executed on the server, arbitrary operating system commands run under the privileges of the application process.

This is a code injection weakness [CWE-94] where the trust boundary between prompt input, model output, and code execution has collapsed. Any user who can submit prompts to the plugin can execute code on the backend.

Root Cause

The root cause is unsafe execution of LLM-generated code derived from untrusted prompt input. The plugin treats model output as trusted logic rather than untrusted data. There is no interpreter isolation, no filesystem or network egress restriction, and no static analysis of generated code before execution.

Attack Vector

Exploitation occurs over the network against an authenticated user of the application. The attacker submits a prompt engineered to bypass the plugin's intended behavior and instruct the LLM to emit Python code that runs system commands, reads sensitive files, opens reverse shells, or exfiltrates API keys and model credentials stored on the server. Because the code executes inside the application context, adversaries can pivot to internal services and cloud metadata endpoints reachable from the host.

See the Huntr bug bounty listing for the original report and technical background.

Detection Methods for CVE-2024-10950

Indicators of Compromise

Unexpected child processes spawned by the gpt_academic Python process, particularly sh, bash, curl, wget, or nc.
Outbound network connections from the application host to unfamiliar IPs or paste sites shortly after CodeInterpreter plugin invocations.
New or modified files in the application working directory, including scripts written to /tmp and cron entries.
Reads of sensitive files such as /etc/passwd, .env, or cloud metadata endpoints (169.254.169.254) originating from the app process.

Detection Strategies

Correlate CodeInterpreter plugin request logs with process execution telemetry to flag command execution outside the expected Python interpreter scope.
Alert on Python processes invoking subprocess, os.system, or eval at runtime when triggered by user-facing plugin sessions.
Baseline normal outbound connections from the gpt_academic host and alert on deviations tied to plugin activity.

Monitoring Recommendations

Enable verbose logging of prompt inputs and generated code within the plugin for post-incident review.
Forward host process, file, and network telemetry to a centralized analytics platform for correlation with application logs.
Monitor for unauthorized changes to the model configuration, API keys, and plugin source files.

How to Mitigate CVE-2024-10950

Immediate Actions Required

Disable the CodeInterpreter plugin in gpt_academic deployments until a patched release is applied.
Restrict access to the gpt_academic web interface to trusted, authenticated users on internal networks only.
Rotate any API keys, model credentials, and secrets present on the application host, assuming exposure.
Audit process and network logs from the application server for indicators consistent with post-exploitation activity.

Patch Information

No vendor patch or fixed version is listed in the NVD entry at the time of publication. Track the upstream binary-husky/gpt_academic repository and the Huntr bug bounty listing for remediation updates. Until a fix is available, apply the workarounds below.

Workarounds

Run the application inside a hardened container with a read-only filesystem, dropped Linux capabilities, and no outbound internet egress except to the LLM provider.
Execute any code produced by LLM plugins inside an isolated sandbox such as a gVisor, Firecracker, or nsjail environment with strict resource limits.
Enforce an allowlist of permitted Python modules and reject generated code that imports os, subprocess, socket, or ctypes.
Require human review for prompts submitted to the CodeInterpreter plugin in production environments.

bash

# Example: run gpt_academic in a locked-down Docker container
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=none \
  --pids-limit=128 \
  --memory=1g --cpus=1 \
  -v /srv/gpt_academic/config:/app/config:ro \
  gpt_academic:hardened