CVE-2025-0183

Stored XSS in binary-husky/gpt_academic

State: Published
Severity: 5.4 Medium
Published: Mar 20, 2025
Updated: Mar 20, 2025
Reserved: Jan 2, 2025

Description

A stored cross-site scripting (XSS) vulnerability exists in the Latex Proof-Reading Module of binary-husky/gpt_academic version 3.9.0. This vulnerability allows an attacker to inject malicious scripts into the `debug_log.html` file generated by the module. When an admin visits this debug report, the injected scripts can execute, potentially leading to unauthorized actions and data access.

Scores

CVSS	Score	Vector	Source
3.0	5.4 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	@huntr_ai

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
binary-husky/gpt_academicbinary-husky	latest and earlierAffected

References

https://huntr.com/bounties/53bced90-64a9-4ca2-8f2f-282c4ce84d1f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.