CVE-2024-31224 CRITICAL

CVE-2024-31224: GPT Academic: Pickle deserializing cookies may pose RCE risk

Vendor Binary-Husky
Product gpt_academic
Weakness CWE-502 · Unsafe deserialization
Published April 8, 2024
Last update August 22, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.

Key dates

02Disclosure timeline

April 8, 2024 CVE published
August 22, 2024 Record updated