Threat · curated 2 Aug 2026
NVD - cve-2024-5184
First reported nist.gov
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2024-5184 demonstrates a real, high-severity prompt injection flaw in a deployed LLM-backed product, letting any user with access hijack the service logic and exfiltrate system prompts.
CVE-2024-5184 is a prompt injection vulnerability in the EmailGPT service, whose API allows a malicious user to inject a direct prompt and take over the service logic. Attackers can force the AI service to leak hard-coded system prompts or execute unwanted prompts, and the flaw can be exploited by anyone with access to the service (CVSS 3.x base 9.1 CRITICAL per NIST).
Summary
CVE-2024-5184 is a prompt injection vulnerability in the EmailGPT service, disclosed via a Synopsys CyRC third-party advisory and published in the NVD on 06/05/2024. The service exposes an API that allows a malicious user to inject a direct prompt and take over the service logic, forcing the underlying AI service to leak hard-coded system prompts or execute unwanted prompts.[1]
The weakness is enumerated as CWE-74 (injection). Scoring is divergent between sources: NIST assessed the flaw at CVSS 3.1 9.1 (Critical), whereas the CNA (Synopsys) rated it CVSS 3.1 6.5 (Medium) and CVSS 4.0 8.5 (High). CISA's ADP SSVC assessment recorded no known exploitation and a partial technical impact, and there is no evidence of in-the-wild exploitation in the supplied material.[1]
Disclosure timeline
| Date | Event |
|---|---|
| 2024-06-05 | New CVE received from Synopsys and published in the NVD with description, CVSS vectors, CWE-74, and the Synopsys advisory reference.[1] |
| 2024-06-06 | CISA ADP recorded an SSVC assessment: exploitation 'none', automatable 'no', technical impact 'partial'.[1] |
| 2024-06-18 | NIST performed initial analysis, adding CVSS 3.1 vector (9.1 Critical), CWE-74, and CPE configuration.[1] |
| 2024-11-21 | CVE record updated to add the Synopsys advisory reference.[1] |
| 2026-06-17 | CVE record modified after enrichment by CISA-ADP and Synopsys, adding affected-version data referencing git commit eecfaf2cff58793549dd0c1266ac1d62e0c8811d.[1] |
How it works
EmailGPT uses an API service that fails to neutralize attacker-controlled input before it is passed to a downstream AI component, matching CWE-74 injection. An attacker with access to the service submits a crafted direct prompt that overrides the intended service logic. This allows the attacker to force the AI to leak its standard hard-coded system prompts or to execute unwanted prompts, including returning harmful information when a malicious prompt requests it. Per the advisory, the issue can be exploited by any individual with access to the service.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| EmailGPT | Version 0 up to and including git commit eecfaf2cff58793549dd0c1266ac1d62e0c8811d (CPE cpe:2.3:a:emailgpt:emailgpt:-) | No patch or fixed version is stated in the supplied evidence; default status recorded as 'unknown'.[1] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2024-5184 | Identifier for the EmailGPT prompt injection vulnerability.[1] |
Key takeaways
- EmailGPT's API accepts attacker-controlled prompts that can override service logic, allowing extraction of hard-coded system prompts and execution of arbitrary prompts — a concrete illustration of CWE-74 injection risk in LLM-backed services.[1]
- Severity assessment is contested: NIST rates the flaw Critical (9.1) while the CNA Synopsys rates it Medium (6.5 CVSS 3.1 / 8.5 CVSS 4.0), and CISA's SSVC records no known exploitation, so defenders should weigh both scores when prioritizing.[1]