This vulnerability involves a cross-site scripting flaw in the WebSocket interface of assafelovic gpt-researcher (up to version 3.4.3). Manipulating the 'task' argument in the WebSocket communication can lead to injection of malicious scripts. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been published by the vendor as of the data provided.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. Since the vulnerability is in a WebSocket interface, it may affect users interacting with the affected component. The exploit is publicly available, increasing the risk of attacks, although no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable WebSocket interface or implementing input validation and output encoding on the 'task' argument to mitigate XSS risks. Monitor vendor channels for updates and apply patches promptly once available.