PT-2024-23865 · Unknown · Gpt Academic

Qhaoduoyu · Published 2024-04-08 · Updated 2025-11-04 · CVE-2024-31224

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gpt academic versions 3.64 through 3.73

Description A vulnerability was found in gpt academic where the server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable.

Recommendations For gpt academic versions 3.64 through 3.73, upgrade to version 3.74, which contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-31224

GHSA-JCJC-89WR-VV7G

Affected Products

Gpt Academic

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31224.json · Exploit
• https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-jcjc-89wr-vv7g · Vendor Advisory
• https://github.com/binary-husky/gpt_academic/commit/8af6c0cab6d96f5c4520bec85b24802e6e823f35 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-31224 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31224 · Vendor Advisory
• https://github.com/binary-husky/gpt_academic/pull/1648 · Note
• https://twitter.com/VulmonFeeds/status/1777405426604097676 · Twitter Post
• https://t.me/cveNotify/141676 · Telegram Post
• https://twitter.com/CVEnew/status/1777363316358455663 · Twitter Post
• https://t.me/cvenotify/76062 · Telegram Post
• https://twitter.com/cracbot/status/1777569290528460917 · Twitter Post