A critical remote code execution vulnerability exists in GPT Academic version 3.91, posing a severe risk of full system compromise via deserialization of untrusted data.

The flaw resides within the stream_daas function, where improper validation of user supplied data leads to the deserialization of untrusted input. This allows an unauthenticated remote attacker to execute arbitrary code in the context of the root user.

Successful exploitation of this vulnerability grants an attacker full control over the host system, facilitating unauthorized data access, system modification, or complete service disruption. Given the CVSS score of 8.1, this represents a High severity risk that could lead to significant reputational and operational damage if exploited in production environments.

Immediate Action: Monitor vendor communications closely for the release of an official security patch and apply it immediately upon availability.

Proactive Monitoring: Review system logs for unusual network traffic directed at the stream_daas function and monitor for unauthorized process execution originating from the application service.

Compensating Controls: Implement strict network segmentation or Web Application Firewall rules to block unauthorized traffic to the application endpoints, specifically targeting the identified vulnerable function.

Public Exploit Available: Unknown

Due to the critical nature of remote code execution, organizations running GPT Academic 3.91 must treat this vulnerability with the highest priority. Until an official patch is released, administrators should isolate the affected software from the public internet and apply the recommended compensating controls to reduce the attack surface.