The vulnerability CVE-2026-5633 affects assafelovic gpt-researcher versions 3.4.0 through 3.4.3. It involves a server-side request forgery flaw in the ws Endpoint component, specifically through manipulation of the source_urls argument. This allows an unauthenticated remote attacker to cause the server to make unintended requests. The vulnerability has been publicly disclosed, but no official patch or remediation has been provided by the vendor as of the publication date.

Successful exploitation of this SSRF vulnerability could allow an attacker to induce the affected server to send crafted requests to internal or external systems, potentially leading to information disclosure or interaction with internal services. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild at this time.

As of the current information, no official fix or patch is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing network-level controls to restrict outbound requests from the affected component as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.