Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`

In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code execution (RCE) on the app backend server by injecting malicious code through the prompt.

N/A

对生成代码的控制不恰当(代码注入)

GPT Academic 命令注入漏洞

GPT Academic是binary-husky个人开发者的一个为 GPT/GLM 等 LLM 大语言模型提供实用化交互的接口。 GPT Academic存在命令注入漏洞，该漏洞源于manim插件中处理用户提供的提示不当，可能导致远程代码执行。

N/A

N/A