CVE-2024-10954: Binary-husky Gpt Academic RCE Vulnerability

CVE-2024-10954 Overview

CVE-2024-10954 is a remote code execution (RCE) vulnerability in the manim plugin of binary-husky/gpt_academic. The plugin executes untrusted code generated by a large language model (LLM) without a sandbox. An attacker with low-privileged access can inject malicious code through a crafted prompt and execute arbitrary commands on the application backend server. The flaw is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can achieve full remote code execution on the backend host by submitting a crafted prompt to the manim plugin, compromising confidentiality, integrity, and availability.

Affected Products

binary-husky/gpt_academic versions prior to the fix
Deployments exposing the manim plugin to user-submitted prompts
Self-hosted instances integrating LLM-generated code execution paths

Discovery Timeline

2025-03-20 - CVE-2024-10954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10954

Vulnerability Analysis

The manim plugin accepts a natural-language prompt and forwards it to an LLM to generate Python code for rendering animations. The generated code is then executed directly on the backend host. Because no sandbox, allowlist, or static analysis gates the execution step, an attacker who controls the prompt can shape the LLM output to include arbitrary Python payloads. The runtime executes those payloads with the same privileges as the gpt_academic process.

This pattern illustrates a broader class of LLM-driven code-injection weaknesses in which prompt content is treated as trusted logic. The exposure requires only low privileges and no user interaction, and it can be reached over the network.

Root Cause

The root cause is the absence of an isolation boundary between LLM-generated code and the host runtime. The plugin trusts model output as safe Python and passes it to an execution routine such as exec or a subprocess call. Prompt-driven code generation makes the attacker an indirect author of the executed program.

Attack Vector

An authenticated user submits a crafted prompt to the manim plugin that instructs the LLM to emit Python code containing operating-system commands, reverse shells, or file-system operations. When the backend executes the generated script, the injected payload runs. Details are documented in the Huntr Bug Bounty Report.

No verified public proof-of-concept code is available. Technical mechanics are described in the referenced Huntr report.

Detection Methods for CVE-2024-10954

Indicators of Compromise

Unexpected child processes spawned from the gpt_academic Python runtime, such as sh, bash, curl, wget, or python -c.
Outbound network connections from the application host to unfamiliar IPs or domains following manim plugin usage.
New or modified files under the plugin working directory that do not correspond to legitimate animation artifacts.
Application logs showing manim prompt submissions immediately preceding anomalous process activity.

Detection Strategies

Monitor process ancestry for the gpt_academic service and alert on shell or interpreter invocations outside the expected manim render chain.
Correlate prompt submission events with subsequent system calls, file writes, and outbound sockets on the backend host.
Inspect LLM-generated code artifacts written to disk for imports such as os, subprocess, socket, or ctypes.

Monitoring Recommendations

Enable verbose audit logging on the gpt_academic host, including execve events via auditd or eBPF-based tooling.
Capture egress traffic from the application server and baseline expected destinations.
Retain plugin prompt and response logs for forensic review of suspected injection attempts.

How to Mitigate CVE-2024-10954

Immediate Actions Required

Upgrade binary-husky/gpt_academic to a fixed version that addresses the manim plugin execution path.
Disable the manim plugin in configuration if a patched build is not yet available.
Restrict access to the gpt_academic interface to trusted, authenticated users only, and remove anonymous or public exposure.
Run the application under a low-privilege service account with no write access to system directories.

Patch Information

No vendor advisory URL is published in the NVD record. Refer to the Huntr Bug Bounty Report for fix references and track the upstream binary-husky/gpt_academic repository for the remediating commit.

Workarounds

Execute LLM-generated code inside an isolated sandbox such as a rootless container, firejail, nsjail, or a disposable virtual machine with no network egress.
Apply strict allowlists on Python imports and disable dangerous modules including os, subprocess, socket, and ctypes in the execution environment.
Introduce a code-review or static-analysis gate that inspects generated scripts before execution.
Enforce network egress filtering on the backend host to block unexpected outbound traffic.

bash

# Example: run the plugin worker inside an isolated, network-restricted namespace
nsjail \
  --mode o \
  --chroot /var/sandbox/manim \
  --user 65534 --group 65534 \
  --disable_clone_newnet=false \
  --time_limit 60 \
  --rlimit_as 512 \
  -- /usr/bin/python3 /opt/manim/render.py