CVE-2026-5625mediumCWE-79CWE-94

CVE-2026-5625: fallo de gravedad media en assafelovic gpt-researcher

assafelovic gpt-researcher WebSocket researcher.py cross site scripting

Publicada el

Seguir esta CVE+ Monitorear gpt-researcher

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.3%
A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/researcher.py of the component WebSocket Interface. Executing a manipulation of the argument task can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
assafelovic · gpt-researcher
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — assafelovic gpt-researcher

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-5632MEDIUMassafelovic gpt-researcher HTTP REST API Endpoint missing authenticationEPSS 0.4%CVE-2026-5630MEDIUMassafelovic gpt-researcher Report API app.py cross site scriptingEPSS 0.3%CVE-2026-5631MEDIUMassafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injectionEPSS 0.3%CVE-2026-5633MEDIUMassafelovic gpt-researcher ws Endpoint server-side request forgeryEPSS 0.3%