GPT Academic Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in GPT Academic due to deserialization of untrusted data in the stream_daas function. This issue arises from inadequate validation of user-supplied data, allowing remote attackers to execute arbitrary code with root privileges. Exploitation requires interaction with a malicious DAAS server, and the attack vectors may vary based on the implementation.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the root user.

Remediation

The primary mitigation strategy is to restrict interactions with the product.