This vulnerability involves a cross-site scripting (XSS) flaw in the assafelovic gpt-researcher software versions 3.4.0 through 3.4.3. The affected code is in an unspecified function within the Report API component of backend/server/app.py. The vulnerability allows remote attackers to inject malicious scripts, potentially leading to client-side code execution when a user interacts with the affected functionality. The vulnerability has been publicly disclosed, and proof-of-concept exploit code is available. The vendor has not yet issued a fix or official response.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction to be exploited and does not require privileges or authentication. The medium CVSS score reflects the moderate risk posed by this vulnerability. No known exploits are reported in the wild beyond the published proof-of-concept.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider implementing web application firewalls or input validation controls as temporary mitigations. Monitor the vendor's channels for updates or official patches. Avoid exposing the vulnerable Report API functionality to untrusted users until a fix is released.