Threat database

CVE-2026-5633 is a server-side request forgery (SSRF) vulnerability in the assafelovic gpt-researcher product versions up to 3.4.3. The vulnerability exists in an unspecified function of the ws Endpoint component, where manipulation of the argument source_urls can lead to SSRF. The vulnerability can be exploited remotely without authentication. The issue has been publicly disclosed, but the vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating medium severity.

CVE-2026-5632 is a medium-severity vulnerability in assafelovic gpt-researcher versions up to 3.4.3. It involves missing authentication on an unspecified HTTP REST API endpoint, allowing remote attackers to manipulate the service without authentication. The vulnerability was publicly disclosed and an exploit is available, but the vendor has not yet responded or provided a fix. No official patch or remediation guidance is currently available.

CVE-2026-5631 is a code injection vulnerability in the assafelovic gpt-researcher software versions up to 3.4.3. It affects the extract_command_data function in the backend/server/server_utils.py file, specifically in the ws Endpoint component. The vulnerability allows remote attackers to manipulate the args argument to inject code. The issue has been publicly disclosed, but the vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-5630 is a cross-site scripting (XSS) vulnerability in the assafelovic gpt-researcher product up to version 3.4.3. The flaw exists in an unknown function within the Report API component located in backend/server/app.py. This vulnerability can be exploited remotely and requires user interaction. Although the issue was reported early to the project, no response or fix has been provided yet. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-5625 is a cross-site scripting (XSS) vulnerability in the assafelovic gpt-researcher product versions up to 3.4.3. The issue arises from improper handling of the 'task' argument in the WebSocket Interface component, specifically in the file gpt_researcher/skills/researcher.py. This vulnerability can be exploited remotely and the exploit code is publicly available. The vendor has been informed but has not yet responded or provided a fix. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.