CVE-2024-12389

Summary

CVE-2024-12389 is a newly disclosed path traversal vulnerability impacting the gpt_academic version 310122f of the binary-husky tool. The flaw lies in the application's handling of user-supplied 7z files, as it fails to validate file paths during the extraction process. The underlying issue is with the employed Python py7zr package, which does not maintain strict control over the extracted files, potentially allowing them to be written outside the intended directory. An attacker can exploit this vulnerability to execute arbitrary file writes, increasing the risk of remote code execution.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.