This vulnerability in assafelovic gpt-researcher (<= 3.4.3) involves improper handling of the args parameter in the extract_command_data function within the ws Endpoint, leading to code injection. An attacker can remotely exploit this flaw by crafting malicious input to execute arbitrary code on the affected system. The vulnerability has been publicly disclosed, but no official patch or remediation has been released by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the server running the vulnerable gpt-researcher versions. This can lead to unauthorized control over the affected system, potentially compromising confidentiality, integrity, and availability. The CVSS score of 6.9 reflects a medium impact with network attack vector and no privileges or user interaction required.

As of now, no official fix or patch is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing compensating controls such as restricting network access to the ws Endpoint or using application-layer firewalls to detect and block malicious input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.