CVE-2024-12390
A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's own code.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.63%
- CWE
- CWE-59
- Published
- 2025-03-20
- Last modified
- 2026-03-13
Affected products
- binary-husky binary-husky/gpt_academic
Weakness type
Related vulnerabilities
- CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-78622 — Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
- CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
- CVE-2026-69425 — Windows NTFS Tampering Vulnerability
- CVE-2026-69289 — Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83999 — Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2026-70563 — Windows Shell Spoofing Vulnerability
- CVE-2026-69771 — Windows Container Manager Service Security Feature Bypass Vulnerability