CVE-2025-57806mediumCWE-312CWE-522

CVE-2025-57806: falha de média gravidade em LearningCircuit local-deep-research

Local Deep Research's API keys are stored in plain text

Publicada em

Seguir esta CVE+ Monitorar local-deep-research

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.1%
Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
LearningCircuit · local-deep-research
CVEs relacionadas — LearningCircuit local-deep-research

No mesmo produto, das mais perigosas para as menos.

CVE-2026-43979MEDIUMLocal Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)EPSS 0.3%CVE-2025-67743MEDIUMLocal Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download ServiceEPSS 0.3%CVE-2026-46526MEDIUMLocal Deep Research: SSRF bypass in `safe_get`EPSS 0.3%