CVE-2024-31224: critical vulnerability in binary-husky gpt_academic
GPT Academic: Pickle deserializing cookies may pose RCE risk
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.2%
GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
binary-husky · gpt_academicRelated CVEs — binary-husky gpt_academic
In the same product, most dangerous first.
CVE-2025-10236MEDIUMbinary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversalEPSS 0.8%CVE-2023-33979MEDIUMgpt_academic's Configuration File vulnerable to File Information DisclosureEPSS 0.7%CVE-2025-25185HIGHGPT Academic allows arbitary file read by tarfile uncompress within softlinkEPSS 0.6%