EUVD-2026-63377
GHSA-c7h4-fvq7-3fpm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity and required user interaction (crawl initiation); unchanged scope and low impact on all three pillars consistent with CVSS 4.0 VC:L/VI:L/VA:L/SC:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The reported GitHub issue was closed with the label "not planned".
AnalysisAI
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a PentestGPT user actively invoke the Web-Page Crawling feature against an attacker-controlled URL or webpage - this is the passive user interaction captured by UI:P in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The composite risk picture is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious webpage that crafts a Traceback argument value containing injection payloads targeting PentestGPT's crawling pipeline. A PentestGPT user who directs the tool to crawl that attacker-controlled URL triggers the vulnerable code path, causing the injected content to be processed downstream with limited data disclosure or manipulation as a result. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the GitHub issue was closed as 'not planned', meaning upstream does not intend to ship a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today