CVE-2024-37743

The vulnerability stems from CWE-94 (Improper Control of Generation of Code, 'Code Injection'), which typically involves unsafe handling of user-controlled input in code generation, template processing, or object deserialization contexts. In mmzdev KnowledgeGPT v0.0.5, the Document Display Component—responsible for rendering and processing uploaded or referenced documents—fails to properly sanitize or validate document content before processing. This likely allows attackers to inject malicious code through crafted document payloads. The vulnerability may involve unsafe deserialization of document objects, template injection in document rendering engines, or direct code generation from document metadata. KnowledgeGPT is a document intelligence platform integrating large language models with document processing; the Document Display Component handles parsing and rendering of multiple document formats (PDF, DOCX, etc.), creating a high-risk attack surface when input validation is inadequate.