GPT Academic Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in GPT Academic, specifically within the upload endpoint. This issue arises from inadequate validation of user-supplied data, leading to the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on the affected system with root privileges. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the root user.

Remediation

Given the nature of this vulnerability, the primary recommendation is to limit interactions with the product.