CVE-2024-10101

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-10101

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10101.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-10101

Published

2024-10-17T18:12:21.623Z

Modified

2026-07-15T01:49:01.994833895Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS in binary-husky/gpt_academic

Details

A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10101.json"
}

References

Affected packages

Git / github.com/binary-husky/gpt_academic

Affected ranges

Type

GIT

Repo

https://github.com/binary-husky/gpt_academic

Events

Introduced

573dc4d1844705b738d3c830774c4d10dca96fad

Last affected

573dc4d1844705b738d3c830774c4d10dca96fad

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:binary-husky:gpt_academic:3.83:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.83"
        },
        {
            "last_affected": "3.83"
        }
    ]
}

Affected versions

3.*

3.83

version3.*

version3.83

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10101.json"