What is the CVSS score of CVE-2025-65720?

CVE-2025-65720 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GPT Researcher are affected by CVE-2025-65720?

GPT Researcher v3.3.7 is vulnerable to unauthenticated remote code execution through command injection when processing web content, allowing attackers to execute arbitrary OS commands on affected…

How to fix or mitigate CVE-2025-65720?

Within 24 hours, inventory all systems running GPT Researcher v3.3.7 and immediately restrict their outbound network access or isolate them from production networks; notify all users to cease using the tool pending remediation. Within 7 days, evaluate and implement a patched or alternative research tool; if continuing use is necessary, configure strict network controls to prevent external web content fetching and implement host-based command execution monitoring. Within 30 days, decommission GPT Researcher v3.3.7 entirely across the organization, migrate all users to approved alternatives, and conduct forensic review of systems that may have been compromised during the exposure window.

GPT Researcher CVE-2025-65720

EUVD-2025-210474 CRITICAL

Command Injection (CWE-77)

2026-07-15 mitre

GHSA-8j86-h8gg-797p

Command Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and unauthenticated, but the description requires the agent to fetch a crafted page, so UI:R rather than the NVD's UI:N; command injection yields full C/I/A on the host.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 19:23 vuln.today

CVSS changed

Jul 16, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 15, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

AnalysisAI

Remote command execution in Open Source GPT Researcher v3.3.7 lets attackers run arbitrary OS commands on a victim's machine when the user interacts with a crafted HTML page, exploiting a command injection (CWE-77) weakness. The flaw was reported by MITRE and detailed in ox.security research covering RCE across the AI/MCP ecosystem; no public exploit is identified in CISA KEV, and EPSS probability is low (0.21%). Because GPT Researcher autonomously fetches and processes web content, a malicious page encountered during a research run can drive execution on the host.

Technical ContextAI

GPT Researcher is an open-source autonomous research agent (Python) that crawls, scrapes, and synthesizes web content, often invoking system-level tooling and external processes as part of its pipeline. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning attacker-influenced content (a crafted HTML page ingested by the agent) reaches a command interpreter or shell without adequate sanitization, allowing injected commands to execute. CPE data is uninformative here (cpe:2.3:a:n/a:n/a:*), so the affected component is identified from the vendor repository (assafelovic/gpt-researcher) and the ox.security advisory rather than structured NVD product data. This class of flaw is characteristic of AI agents that pass fetched/tool-derived content into subprocess or shell calls.

RemediationAI

No vendor-released patch version is identified in the provided data at time of analysis; monitor the upstream repository (https://github.com/assafelovic/gpt-researcher) and the ox.security advisory (https://www.ox.security/blog/gpt-researcher-remote-code-execution) for a fixed release beyond 3.3.7 and upgrade as soon as one is published. As compensating controls, run GPT Researcher inside a locked-down sandbox or container with no shell access and a non-privileged user so injected commands cannot reach the host (trade-off: added deployment complexity); restrict or allowlist the URLs/domains the agent is permitted to fetch to keep it away from attacker-controlled pages (trade-off: reduces research coverage); and apply egress network filtering and least-privilege file/system permissions to limit post-exploitation impact. Avoid pointing the agent at untrusted or user-supplied URLs until a patched version is confirmed.