Local Deep Research CVE-2025-67743

Exploitation requires authenticated access to the application API (PR:L): the attacker must be able to POST a crafted URL to /api/resources/<research_id> and then invoke /library/api/download/<resource_id> to trigger the download. It affects Local Deep Research versions 1.3.0 up to (but not including) 1.3.9, where download_service.py uses raw requests.get() instead of the existing safe_requests.py wrapper. Realized confidentiality impact is LIMITED by the deployment: the attacker only gains value if the host can actually reach sensitive internal services or cloud provider metadata endpoints (AWS/GCP/Azure 169.254.169.254), and the advisory explicitly notes impact depends on 'surrounding controls.' No user interaction is required, and no special non-default feature toggle is needed - the download service is standard functionality.

This is a genuine but moderate-priority SSRF (CWE-918) in Local Deep Research versions 1.3.0 to before 1.3.9. The signals are internally consistent rather than conflicting: the CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation requiring low-level privileges (PR:L), with high confidentiality impact and no integrity or availability impact - consistent with an SSRF that reads internal/metadata responses but does not alter or disrupt the system. Publicly available exploit code exists (the GHSA advisory includes a detailed PoC), which raises practical exploitability, but this should not be conflated with active exploitation. The EPSS score is low (0.32%, 23rd percentile) and the CVE is NOT on CISA KEV, so there is no public exploit identified as actively used in the wild. The net picture is a real, verifiable flaw with a working PoC but a limited real-world footprint and no evidence of mass exploitation - prioritize patching for anyone running this product, especially in cloud environments where metadata endpoints are reachable, but it is not an emergency-tier internet-wide threat. One nuance to verify: the advisory states impact 'depends on the deployment and surrounding controls,' so actual confidentiality impact (C:H) hinges on whether sensitive internal services or cloud metadata endpoints are actually reachable from the host.

An attacker with authenticated API access submits a malicious URL (e.g., http://169.254.169.254/latest/meta-data/) via POST /api/resources/<research_id>, which is stored without SSRF validation. The attacker then triggers /library/api/download/<resource_id>, causing download_service.py to fetch the URL via raw requests.get(), bypassing the application's safe_requests SSRF protection and returning cloud metadata or internal service responses. A public PoC demonstrating this chain with a mock internal service is published in the GHSA advisory.