GPT Academic Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in GPT Academic, specifically within the run_in_subprocess_wrapper_func function. This issue arises from improper validation of user-supplied data, leading to the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on affected installations with root privileges. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the root user.

Remediation

Given the nature of this vulnerability, the primary mitigation strategy is to limit interaction with the product.