Is there a public PoC exploit available for EUVD-2026-19178?

Yes, a public proof-of-concept exploit is available for EUVD-2026-19178. Prioritise patching immediately. EPSS: 0.0%.

Gpt Researcher EUVD-2026-19178

Q: What is the CVSS score of EUVD-2026-19178?

EUVD-2026-19178 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5625 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 VulDB

GHSA-9v4r-x2jq-w7jg

XSS Gpt Researcher Assafelovic

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 05:45 euvd

EUVD-2026-19178

Analysis Generated

Apr 06, 2026 - 05:45 vuln.today

CVE Published

Apr 06, 2026 - 05:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/researcher.py of the component WebSocket Interface. Executing a manipulation of the argument task can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Cross-site scripting (XSS) vulnerability in assafelovic gpt-researcher up to version 3.4.3 allows unauthenticated remote attackers to inject malicious scripts via manipulation of the task argument in the WebSocket Interface component. Publicly available exploit code exists, and the vulnerability affects the file gpt_researcher/skills/researcher.py with low CVSS severity (4.3) but confirmed proof-of-concept availability indicating active technical feasibility.

Technical ContextAI

The vulnerability is a stored or reflected cross-site scripting flaw (CWE-79) in the WebSocket Interface component of gpt-researcher, a research automation tool. The weakness exists in the task parameter processing within the researcher.py skill module. When user-controlled input from the task argument is not properly sanitized or encoded before being rendered in a web context, an attacker can inject malicious JavaScript code that will execute in the victim's browser. The affected product is a Python-based research agent framework that uses WebSocket communication; the vulnerability stems from insufficient input validation on the task parameter, allowing XSS payload injection through this web interface endpoint.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor has not responded to the early notification. Users should immediately implement input sanitization and output encoding for the task parameter in the WebSocket Interface, ensuring all user-supplied values are properly escaped before rendering in HTML or JavaScript contexts. As a temporary mitigation, restrict access to the WebSocket endpoint to trusted users only, implement Content Security Policy (CSP) headers to limit script execution, or disable the WebSocket Interface if not actively required. Monitor the official GitHub repository (https://github.com/assafelovic/gpt-researcher/) for security updates and patch releases. Users should also review application logs for evidence of XSS payload injection attempts via the task parameter.