CVE-2026-5630
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A cross-site scripting vulnerability has been found in assafelovic gpt-researcher up to version 3.4.3 in the Report API component in file backend/server/app.py.
Risk Assessment
The attack can be carried out remotely, and the exploit has been published, increasing the risk of exploitation. It could lead to data theft or other attacks.
Recommendation
Contact the project author for patches or apply temporary mitigations such as input validation.
Original NVD description (English source)
A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.