A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution… (CVE-2026-37006)

CVE-2026-37006 is a critical security vulnerability affecting the WebSocket endpoint of gpt-researcher versions 0.14.7 and earlier. It allows unauthenticated remote attackers to achieve remote code execution by exploiting malicious Model Context Protocol configurations. The vulnerability is classified under CWE-287 (Improper Authentication) and has a CVSS 3.1 base score of 9.8, reflecting its severity and ease of exploitation without privileges or user interaction. No official patch or fix details are currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected system, leading to full compromise of confidentiality, integrity, and availability of the system running gpt-researcher v0.14.7 or earlier. This can result in unauthorized control over the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WebSocket endpoint and monitor for suspicious activity related to Model Context Protocol configurations. Avoid exposing the vulnerable service to untrusted networks.