Is there a public PoC exploit available for CVE-2026-5630?

Yes, a public proof-of-concept exploit is available for CVE-2026-5630. Prioritise patching immediately. EPSS: 0.0%.

Gpt Researcher CVE-2026-5630

Q: What is the CVSS score of CVE-2026-5630?

CVE-2026-5630 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19184 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 VulDB

XSS Gpt Researcher Assafelovic

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 07:00 euvd

EUVD-2026-19184

Analysis Generated

Apr 06, 2026 - 07:00 vuln.today

CVE Published

Apr 06, 2026 - 06:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Stored cross-site scripting (XSS) in assafelovic gpt-researcher versions up to 3.4.3 allows unauthenticated remote attackers to inject malicious scripts via the Report API in backend/server/app.py. The vulnerability requires user interaction (report viewing) to trigger payload execution and carries low integrity impact (CVSS 4.3). Publicly available exploit code exists, and the vendor has not addressed the issue despite early notification.

Technical ContextAI

The vulnerability is a reflected or stored XSS flaw (CWE-79) in the Report API endpoint of gpt-researcher's backend server component. The affected file backend/server/app.py fails to properly sanitize or encode user-supplied input before rendering it in web responses. The underlying technology involves Python-based API handling in gpt-researcher, a research automation framework. The CPE indicates all versions of assafelovic's gpt-researcher product are in scope, with confirmed impact through version 3.4.3. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the attack surface is a network-accessible API endpoint requiring only user interaction (such as clicking a malicious link or visiting a crafted report) to execute injected scripts in the victim's browser context.

RemediationAI

No vendor-released patched version identified at time of analysis; the project has not responded to the early notification. Users should immediately review whether gpt-researcher's Report API is exposed to untrusted users in their environment. As a temporary mitigation, implement strict input validation and output encoding in the Report API endpoint to sanitize user-supplied content before rendering. Deploy a Web Application Firewall (WAF) with XSS detection rules to filter malicious payloads. Implement Content Security Policy (CSP) headers to restrict inline script execution. Monitor the project's GitHub repository (https://github.com/assafelovic/gpt-researcher/) and VulDB for vendor updates. Consider isolating affected instances or disabling the Report API if not essential to operations until a patch is released.