CVE-2025-57806: fallo de gravedad media en LearningCircuit local-deep-research
Local Deep Research's API keys are stored in plain text
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.1%
Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
LearningCircuit · local-deep-researchCVEs relacionadas — LearningCircuit local-deep-research
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-43979MEDIUMLocal Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)EPSS 0.3%CVE-2025-67743MEDIUMLocal Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download ServiceEPSS 0.3%CVE-2026-46526MEDIUMLocal Deep Research: SSRF bypass in `safe_get`EPSS 0.3%