CVE Catalog
CVE-2026-37006
UnknownSummary
Vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before. An unauthenticated remote attacker can achieve code execution via malicious Model Context Protocol configurations.
Risk Assessment
An unauthenticated attacker can execute arbitrary code on the server, potentially leading to system takeover and data confidentiality breach.
Recommendation
Update gpt-researcher to the latest version. Restrict access to the WebSocket endpoint and validate all MCP configurations.
Original NVD description (English source)
A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.