The vulnerability CVE-2026-5631 exists in assafelovic gpt-researcher versions 3.4.0 through 3.4.3. It involves the extract_command_data function in the backend server utilities, where improper handling of the args parameter in the ws Endpoint enables remote code injection. This allows an unauthenticated attacker to execute arbitrary code remotely. The vulnerability was reported early to the project but remains unpatched as of the publication date. No official remediation or patch has been released by the vendor.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on the affected system without requiring authentication. This could lead to compromise of the system running gpt-researcher, potentially enabling further attacks or unauthorized access. The CVSS score of 6.9 reflects a medium severity impact with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level protections such as restricting access to the ws Endpoint and monitoring for suspicious activity related to the args parameter. Avoid exposing the vulnerable versions to untrusted networks until a patch or official mitigation is available.