https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-0764.htmlhttps://patchthecve.com/cve/CVE-2026-0764.htmlWed, 17 Jun 2026 10:11:20 +0000CRITICAL 9.8: GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within thhttps://patchthecve.com/cve/CVE-2026-0763.htmlhttps://patchthecve.com/cve/CVE-2026-0763.htmlWed, 17 Jun 2026 10:11:20 +0000CRITICAL 9.8: GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specifhttps://patchthecve.com/cve/CVE-2026-0762.htmlhttps://patchthecve.com/cve/CVE-2026-0762.htmlWed, 17 Jun 2026 10:11:20 +0000HIGH 8.1: GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attachttps://patchthecve.com/cve/CVE-2025-10236.htmlhttps://patchthecve.com/cve/CVE-2025-10236.htmlWed, 17 Jun 2026 08:27:57 +0000MEDIUM 4.3: A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input{} leads to path traversal. The attack may be launchedhttps://patchthecve.com/cve/CVE-2025-0183.htmlhttps://patchthecve.com/cve/CVE-2025-0183.htmlWed, 17 Jun 2026 08:26:01 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability exists in the Latex Proof-Reading Module of binary-husky/gpt_academic version 3.9.0. This vulnerability allows an attacker to inject malicious scripts into the `debug_log.html` file generated by the module. When an admin visits this debug report, thehttps://patchthecve.com/cve/CVE-2024-12392.htmlhttps://patchthecve.com/cve/CVE-2024-12392.htmlWed, 17 Jun 2026 06:59:38 +0000MEDIUM 6.5: A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functionality to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this vulnerability to make the application access any URL, https://patchthecve.com/cve/CVE-2024-12391.htmlhttps://patchthecve.com/cve/CVE-2024-12391.htmlWed, 17 Jun 2026 06:59:38 +0000MEDIUM 6.5: A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The function '解析项目源码（手动指定和筛选源码文件类型）' permits the execution of user-provided regular expressions. Certain regular expressions can cause the Python RE engine to take exhttps://patchthecve.com/cve/CVE-2024-12390.htmlhttps://patchthecve.com/cve/CVE-2024-12390.htmlWed, 17 Jun 2026 06:59:38 +0000HIGH 8.8: A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. Thishttps://patchthecve.com/cve/CVE-2024-12389.htmlhttps://patchthecve.com/cve/CVE-2024-12389.htmlWed, 17 Jun 2026 06:59:37 +0000HIGH 8.8: A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction dhttps://patchthecve.com/cve/CVE-2024-12388.htmlhttps://patchthecve.com/cve/CVE-2024-12388.htmlWed, 17 Jun 2026 06:59:37 +0000MEDIUM 6.5: A vulnerability in binary-husky/gpt_academic version 310122f allows for a Regular Expression Denial of Service (ReDoS) attack. The application uses a regular expression to parse user input, which can take polynomial time to match certain crafted inputs. This allows an attacker to send a small malicihttps://patchthecve.com/cve/CVE-2024-12387.htmlhttps://patchthecve.com/cve/CVE-2024-12387.htmlWed, 17 Jun 2026 06:59:37 +0000MEDIUM 6.5: A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issuehttps://patchthecve.com/cve/CVE-2024-11039.htmlhttps://patchthecve.com/cve/CVE-2024-11039.htmlWed, 17 Jun 2026 06:56:56 +0000HIGH 8.8: A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclhttps://patchthecve.com/cve/CVE-2024-11037.htmlhttps://patchthecve.com/cve/CVE-2024-11037.htmlWed, 17 Jun 2026 06:56:55 +0000MEDIUM 6.5: A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systemhttps://patchthecve.com/cve/CVE-2024-11033.htmlhttps://patchthecve.com/cve/CVE-2024-11033.htmlWed, 17 Jun 2026 06:56:55 +0000MEDIUM 6.5: A Denial of Service (DoS) vulnerability exists in the file upload feature of binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a payload with an exhttps://patchthecve.com/cve/CVE-2024-11031.htmlhttps://patchthecve.com/cve/CVE-2024-11031.htmlWed, 17 Jun 2026 06:56:55 +0000HIGH 7.5: In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown翻译中) plugin function, which allows downloading arbitrary web hosts by only https://patchthecve.com/cve/CVE-2024-11030.htmlhttps://patchthecve.com/cve/CVE-2024-11030.htmlWed, 17 Jun 2026 06:56:55 +0000HIGH 7.5: GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Acahttps://patchthecve.com/cve/CVE-2024-10986.htmlhttps://patchthecve.com/cve/CVE-2024-10986.htmlWed, 17 Jun 2026 06:56:49 +0000HIGH 8.8: GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. Thttps://patchthecve.com/cve/CVE-2024-10956.htmlhttps://patchthecve.com/cve/CVE-2024-10956.htmlWed, 17 Jun 2026 06:56:46 +0000HIGH 7.1: GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting chttps://patchthecve.com/cve/CVE-2024-10954.htmlhttps://patchthecve.com/cve/CVE-2024-10954.htmlWed, 17 Jun 2026 06:56:46 +0000HIGH 8.8: In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code exehttps://patchthecve.com/cve/CVE-2024-10950.htmlhttps://patchthecve.com/cve/CVE-2024-10950.htmlWed, 17 Jun 2026 06:56:45 +0000HIGH 8.8: In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. Thttps://patchthecve.com/cve/CVE-2024-10948.htmlhttps://patchthecve.com/cve/CVE-2024-10948.htmlWed, 17 Jun 2026 06:56:45 +0000MEDIUM 6.5: A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensitive files such as `config.py`. This issue affects the latest version of the product. An attacker can exploit this vulnerability by intercepting the websocket reqhttps://patchthecve.com/cve/CVE-2024-10819.htmlhttps://patchthecve.com/cve/CVE-2024-10819.htmlWed, 17 Jun 2026 06:56:30 +0000HIGH 8.8: A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can cohttps://patchthecve.com/cve/CVE-2024-10812.htmlhttps://patchthecve.com/cve/CVE-2024-10812.htmlWed, 17 Jun 2026 06:56:29 +0000MEDIUM 6.1: An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-controlled input in the 'file' parameter without proper validation or sanitization. This can be exploited by attackers to conduct phishing athttps://patchthecve.com/cve/CVE-2024-10714.htmlhttps://patchthecve.com/cve/CVE-2024-10714.htmlWed, 17 Jun 2026 06:56:15 +0000HIGH 7.5: A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a multipart boundary during file upload. This results in the server continuously processing each character and displaying warnings, rendering thttps://patchthecve.com/cve/CVE-2025-25185.htmlhttps://patchthecve.com/cve/CVE-2025-25185.htmlWed, 17 Jun 2026 09:00:26 +0000HIGH 7.5: GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it. Subhttps://patchthecve.com/cve/CVE-2024-10101.htmlhttps://patchthecve.com/cve/CVE-2024-10101.htmlWed, 17 Jun 2026 06:54:54 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloahttps://patchthecve.com/cve/CVE-2024-10100.htmlhttps://patchthecve.com/cve/CVE-2024-10100.htmlWed, 17 Jun 2026 06:54:54 +0000HIGH 7.5: A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as cri