This vulnerability involves a cross-site scripting (XSS) issue in the assafelovic gpt-researcher software, specifically affecting versions 3.4.0 through 3.4.3. The affected code resides in an unspecified function of the Report API component in backend/server/app.py. The vulnerability can be exploited remotely without privileges or user interaction, leading to potential injection of malicious scripts. Although an exploit is publicly available, the vendor has not issued any official remediation or patch at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The CVSS score of 5.3 indicates a medium impact level. There is no indication that the vulnerability leads to privilege escalation or direct system compromise.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider implementing web application firewalls or input validation controls as temporary mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.