CVE-2024-10956 Cross-Site WebSocket Hijacking in binary-husky/gpt_academic

What is CVE-2024-10956?

CVE-2024-10956 is a high-severity vulnerability in binary-husky/gpt_academic, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting conversation history without the victim's consent. The issue arises due to insufficient WebSocket authentication and lack of origin validation.

Weakness: CWE-346

Which versions are affected by CVE-2024-10956?

It affects 1 product.

Products include Binary-Husky Gpt Academic.

How do I fix CVE-2024-10956?

No fix has been published for CVE-2024-10956 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-10956 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10956 exists.

Other vulnerabilities in binary-husky/gpt_academic

• CVE-2026-0763 GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2026-0764 GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2024-31224 GPT Academic: Pickle deserializing cookies may pose RCE risk Critical 9.8
• CVE-2024-10950 Code Injection in binary-husky/gpt_academic High 8.8
• CVE-2024-10954 Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim` High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6fwx-j832-vvw6.