binary-husky/gpt_academic
为GPT/GLM等LLM大语言模型提供实用化交互接口，特别优化论文阅读/润色/写作体验，模块化设计，支持自定义快捷按钮&函数插件，支持Python和C++等项目剖析&自译解功能，PDF/LaTex论文翻译&总结功能，支持并行问询多种LLM模型，支持chatglm3等本地模型。接入通义千问, deepseekcoder, 讯飞星火, 文心一言, llama2, rwkv, claude2, moss等。
How gpt_academic is put together
GPT Academic (gpt_academic) is a Gradio-based web application in Python that provides an academic-focused GUI over many large language models (OpenAI, Claude, Qwen/Dashscope, ZhipuGLM, iFlytek Spark, Volcengine, DeepSeek, Gemini, local ChatGLM/MOSS/Llama, etc.) with a modular plugin ('crazy_functions') system for tasks like PDF/LaTeX paper translation, source-code analysis, internet-augmented Q&A, and RAG. Requests flow from the Gradio UI (main.py) through a unified dispatch layer (request_llms/bridge_all.py) to per-model bridge modules that stream responses back to the chat UI. Configuration is centralized in config.py with override precedence environment variable > config_private.py > config.py. It also exposes an optional FastAPI server layer (shared_utils/fastapi_server.py) and Docker-based deployment.
Languages
Frameworks
Datastores
Infrastructure
Major components
Web UI (main.py + themes/)
Builds and serves the Gradio Blocks interface, wiring buttons, plugins, layout, themes, and cookie/history state.
LLM request bridges (request_llms/)
Unified dispatch (bridge_all.py) and per-provider bridge/adapter modules that send prompts to each model and stream replies.
Plugins / crazy_functions
Hot-loadable function plugins implementing academic tasks (PDF/LaTeX translation, code analysis, internet Q&A, RAG, image/audio gen).
Core functional buttons (core_functional.py)
Defines the basic one-click prompt features (polish, translate, explain code) shown in the basic function area.
Configuration system (config.py, shared_utils/config_loader.py)
Central config with env-var/config_private override precedence for API keys, models, proxy, and UI options.
Toolbox utilities (toolbox.py)
Shared helpers for config access, API-key selection/validation, UI updates, upload handling, and chat logging.
Shared utilities & servers (shared_utils/)
FastAPI servers, cookie management, logging, upload handling, key-pattern/text-mask, and markdown formatting.
PDF/LaTeX processing (crazy_functions/pdf_fns, latex_fns, paper_fns)
Parses, breaks down, and translates PDF/LaTeX papers via multiple parsers (Grobid, Nougat, Doc2x) with multi-threading.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (6 advisories) across 15 scanned dependencies.
llama-index-core 0.10.68
3 advisories. Fixed in 0.12.38.
How it can be abusedAn attacker who uploads a crafted document to the knowledge-base or RAG plugins could make LlamaIndex's file readers hang, crash, or fill up temp storage, knocking out the whole web service for everyone using it, since these features run inside the same Gradio server process.
- highGHSA-7753-xrfw-ch36LlamaIndex affected by a Denial of Service (DOS) in JSONReader
- highGHSA-cr7q-2w66-hjcmllama-index-core insecurely handles temporary files
- highGHSA-j3wr-m6xh-64hgLlamaIndex Improper Handling of Exceptional Conditions vulnerability
protobuf 3.20
3 advisories. Fixed in 6.33.5.
How it can be abusedAn attacker who can feed a crafted message into a parser could make the program hang or crash by exhausting memory or recursion limits. Here protobuf is only used to decode replies from trusted vendors like iFlytek Spark, and users never send raw protobuf to the app, so an attacker has no practical way to reach these code paths.
- highGHSA-7gcm-g887-7qv7protobuf affected by a JSON recursion depth bypass
- highGHSA-8gq9-2x98-w8hfprotobuf-cpp and protobuf-python have potential Denial of Service issue
- highGHSA-8qvm-5x2c-j2w7protobuf-python has a potential Denial of Service issue
Code review
27 files reviewed; 2 of 2 claimed findings confirmed after verification.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required