Vulnerability · Published Apr 8, 2024 · Assigned by GitHub_M

CVE-2024-31224GPT Academic: Pickle deserializing cookies may pose RCE risk

Critical 9.8

In plain English

A critical-severity unsafe deserialization in gpt_academic from binary-husky. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.2%top 31.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.

Affected products (as reported)

Vendor	Product	Versions
binary-husky	gpt_academic	>= 3.64, < 3.74

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-jcjc-89wr-vv7g x_refsource_CONFIRM
https://github.com/binary-husky/gpt_academic/pull/1648 x_refsource_MISC
https://github.com/binary-husky/gpt_academic/commit/8af6c0cab6d96f5c4520bec85b24802e6e823f35 x_refsource_MISC