CVE-2024-31224

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31224
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31224.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-31224
Aliases
  • GHSA-jcjc-89wr-vv7g
Published
2024-04-08T15:24:01.084Z
Modified
2026-04-02T10:20:43.556223Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
GPT Academic: Pickle deserializing cookies may pose RCE risk
Details

GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31224.json"
}
References

Affected packages

Git / github.com/binary-husky/gpt_academic

Affected ranges

Type
GIT
Repo
https://github.com/binary-husky/gpt_academic
Events
Introduced
bb431db7d3402d0903f7f0971acfaa445190fe69
Fixed
163f12c533765fa3093134f9b7357ff9dc281fd2

Affected versions

version3.*
version3.64-1
version3.70

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31224.json"