gpt-researcher CVE-2026-37006

Exploitation requires network reachability to the gpt-researcher WebSocket endpoint and the ability to supply a malicious Model Context Protocol (MCP) configuration to it; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against an exposed instance. The concrete prerequisite is that the WebSocket endpoint accepts MCP configuration input - the exact feature named in the description - and that this endpoint is reachable by the attacker. The main limiting factor is exposure: deployments that bind the endpoint to localhost, place it behind an authenticating proxy, or firewall it off are not remotely reachable and thus not exploitable by an external unauthenticated attacker; version must be 0.14.7 or earlier.

The raw signals point to top-tier severity: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N and full C/I/A impact means an unauthenticated, low-complexity, network-reachable RCE requiring no user interaction - the worst-case exposure profile. Countervailing signals temper the urgency somewhat: EPSS is only 0.27% (19th percentile), there is no CISA KEV listing, and no public POC is referenced, indicating no evidence of active or widespread exploitation yet. The tension is that a 9.8 unauthenticated RCE would normally be a patch-now item, and any operator running a gpt-researcher instance exposed to untrusted networks should treat it as urgent even though the exploitation-probability metrics are currently low, because those metrics reflect present activity, not the ease of future exploitation. The CWE-287 mapping ('Authentication Bypass' per tags) is consistent with the PR:N in the vector, which reinforces confidence that no credentials are required; the main uncertainty is whether typical deployments expose the WebSocket endpoint to the network or bind it to localhost, which materially changes real-world reachability.

An attacker locates an internet- or LAN-exposed gpt-researcher WebSocket endpoint and, without any credentials, opens a WebSocket connection and submits a crafted Model Context Protocol configuration referencing an attacker-controlled tool/server. When the agent processes that configuration it executes attacker-supplied code on the host, yielding full command execution. No public exploit is referenced, but the low attack complexity and lack of authentication make weaponization straightforward for a motivated attacker.