The vulnerability CVE-2026-5625 affects assafelovic gpt-researcher versions 3.4.0 through 3.4.3. It is a cross-site scripting flaw caused by insufficient sanitization or validation of the 'task' argument processed in the WebSocket Interface component (gpt_researcher/skills/researcher.py). An attacker can remotely manipulate this argument to inject malicious scripts, potentially leading to XSS attacks. The issue was reported early to the project but no official fix or remediation guidance has been published. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity and availability.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of a victim's browser session interacting with the vulnerable WebSocket interface. This can lead to theft of sensitive information, session hijacking, or other malicious actions typical of XSS attacks. The medium CVSS score reflects moderate risk due to the need for user interaction and limited impact on system integrity and availability. No known exploits in the wild have been reported yet.

As of the current information, no official patch or remediation is available from the vendor. The vendor has not responded to the issue report. Users of affected versions (3.4.0 to 3.4.3) should monitor the vendor's channels for updates or patches. Until a fix is released, consider implementing WebSocket input validation or filtering on the 'task' argument at network or application layers as a temporary mitigation. Avoid exposing the vulnerable interface to untrusted users where possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.