Is CVE-2023-33979 actively exploited?

No active exploitation of CVE-2023-33979 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-33979 be exploited remotely?

Yes. CVE-2023-33979 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-33979?

CVE-2023-33979 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2023-33979

MEDIUM

CVE-2023-33979

CWE-200Published: May 31, 2023· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive files are configured to be off-limits, sensitive information files in some working directories can be read through the `/file` route, leading to sensitive information leakage. This affects users that uses file configurations via `config.py`, `config_private.py`, `Dockerfile`. A patch is available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a workaround, one may use environment variables instead of `config*.py` files to configure this project, or use docker-compose installation to configure this project.

NVD Source

Technical Analysis

CVE-2023-33979 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.