Threats tagged 'ghsa-4pfw-7888-8q2g'

A critical vulnerability exists in the WebSocket endpoint of gpt-researcher version 0.14.7 and earlier. This flaw allows an unauthenticated remote attacker to execute arbitrary code by sending malicious Model Context Protocol configurations. The vulnerability is identified as CVE-2026-37006 and has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided. There are no known exploits in the wild at this time.