CVE-2026-5625
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
gpt-researcher up to 3.4.3 has an XSS vulnerability in the WebSocket interface via the 'task' argument in researcher.php. Remote exploitation is possible and the exploit is public.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, leading to session theft or other attacks.
Recommendation
Update gpt-researcher to a version above 3.4.3 or apply available patches.
Other vulnerabilities in gpt-researcher
See all- CVE-2026-37006Critical
Vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before. An unauthenticated remote attacker can achieve code execution via malicious Model Context Protocol configurations.
- CVE-2025-65720Critical
An issue in GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.
- CVE-2026-5633High
Vulnerability in gpt-researcher up to version 3.4.3 in the ws Endpoint component. Manipulation of the source_urls argument can lead to server-side request forgery (SSRF). The attack is remote and the exploit has been publicly disclosed.
- CVE-2026-5632High
In gpt-researcher up to version 3.4.3, a missing authentication vulnerability was found in an unknown function of the HTTP REST API endpoint. The attack can be performed remotely and the exploit has been made public. The project was informed but has not responded.
- CVE-2026-5631High
Vulnerability in gpt-researcher up to version 3.4.3. The extract_command_data function in backend/server/server_utils.py in the WebSocket component allows remote code injection via manipulation of the args argument. The exploit has been publicly disclosed.
- CVE-2026-5630Medium
A cross-site scripting vulnerability has been found in assafelovic gpt-researcher up to version 3.4.3 in the Report API component in file backend/server/app.py.
Original NVD description (English source)
A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/researcher.py of the component WebSocket Interface. Executing a manipulation of the argument task can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.