by Kastro
Paper/Archive/CVE-2024-31224

CVE-2024-31224

binary-husky gpt_academic — GPT Academic: Pickle deserializing cookies may pose RCE risk

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.6.686 × 2013.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.

Affected

ProductAffectedFixed inSource
gpt_academic>= 3.64, < 3.74–CNA
gpt_academic< 3.743.74CISA-ADP

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/binary-husky/gpt_academic/security/advisories/GHSA-jcjc-89wr-vv7grefgithub.com/binary-husky/gpt_academic/pull/1648refgithub.com/binary-husky/gpt_academic/commit/8af6c0cab6d96f5c4520bec85b24802e6e823f35