Deserialization of untrusted data in gpt_academic (CVE-2024-11039)
gpt_academic contained a vulnerability in its pickle deserialization code that could allow execution of arbitrary code through untrusted data. The vulnerability was fixed by implementing a safer unpickler with a whitelist of allowed classes.
What happened
A deserialization vulnerability existed in gpt_academic's pickle handling code in the latex_fns module, which could allow arbitrary code execution when processing untrusted data.
Governance controls
The vulnerability was resolved by implementing a SafeUnpickler class with a whitelist of approved classes allowed for deserialization, including LatexPaperFileGroup, LatexPaperSplit, LinkedListNode, and numpy classes scalar and dtype.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.