PT-2025-12133 · Unknown+1 · Binary-Husky/Gpt Academic+1

Published 2025-03-20 · Updated 2025-07-31 · CVE-2024-12390

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic version git 310122f

Description A vulnerability in binary-husky/gpt academic allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application’s own code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Link Following

Weakness Enumeration

CWE-475

CWE-59

Related Identifiers

CVE-2024-12390

Affected Products

Binary-Husky/Gpt Academic

Rarfile

References · 7

• 🔥 https://huntr.com/bounties/1add2b26-460d-4aa5-8fda-ab045d153177 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12390 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12390 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902671096165412984 · Twitter Post
• https://t.me/cveNotify/130460 · Telegram Post
• https://twitter.com/CveFindCom/status/1902671871885316228 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1902686496974610560 · Twitter Post