EUVD-2026-19186Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_utils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Remote code injection in gpt-researcher (assafelovic) versions up to 3.4.3 allows unauthenticated attackers to execute arbitrary code via the WebSocket endpoint's extract_command_data function. The vulnerability stems from improper input validation of the 'args' parameter in backend/server/server_utils.py. Publicly available exploit code exists (GitHub issue #1694), though confirmed active exploitation (CISA KEV) has not been reported. With CVSS 7.3 and network-accessible attack vector requiring no authentication, this represents a significant risk to exposed instances, though vendor response remains pending.
Technical ContextAI
This vulnerability affects the gpt-researcher application, an autonomous AI agent framework for comprehensive online research. The flaw resides in the extract_command_data function within backend/server/server_utils.py, specifically handling WebSocket (ws) endpoint communications. The root cause is CWE-94 (Code Injection), where user-supplied data in the 'args' parameter is processed without adequate sanitization before being executed or evaluated. The affected CPE (cpe:2.3:a:assafelovic:gpt-researcher:*:*:*:*:*:*:*:*) indicates all versions through 3.4.3 are vulnerable. WebSocket endpoints are commonly used for real-time bidirectional communication in web applications, and when command processing functions fail to validate input, they become conduits for injecting executable code into the application runtime context.
RemediationAI
No vendor-released patch identified at time of analysis, as the project maintainer has not responded to the vulnerability disclosure reported via GitHub issue #1694. Organizations should immediately implement network-level controls to restrict access to the WebSocket endpoint, limiting exposure to trusted IP ranges or internal networks only. Application-layer input validation should be added to the extract_command_data function to sanitize the 'args' parameter before processing. Consider disabling the vulnerable ws endpoint entirely if not required for operations. Monitor the official GitHub repository (https://github.com/assafelovic/gpt-researcher/) for future security updates. Implement runtime application self-protection (RASP) or web application firewall (WAF) rules to detect and block code injection attempts targeting this endpoint. Review application logs for suspicious WebSocket activity or anomalous command patterns. Given the lack of vendor response, organizations with high security requirements should evaluate alternative research automation solutions or maintain isolated deployment environments with strict access controls.
More in Gpt Researcher
View allMissing authentication in gpt-researcher HTTP REST API (versions ≤3.4.3) allows remote attackers to bypass access contro
Server-side request forgery in gpt-researcher versions up to 3.4.3 allows unauthenticated remote attackers to manipulate
Cross-site scripting (XSS) vulnerability in assafelovic gpt-researcher up to version 3.4.3 allows unauthenticated remote
Stored cross-site scripting (XSS) in assafelovic gpt-researcher versions up to 3.4.3 allows unauthenticated remote attac
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today