Binary-Husky Gpt_Academic Code Injection Vulnerability in CodeInterpreter Plugin Allowing Remote Code Execution

A code injection vulnerability has been identified in the Binary-Husky Gpt_Academic plugin, specifically in versions through 3.83. The issue arises in the CodeInterpreter plugin, where user-provided prompts are executed without a sandbox, allowing untrusted code to run. This vulnerability can be exploited to achieve remote code execution on the application backend server, potentially giving an attacker full control over the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the application backend server, with the potential for full control over the server.