CVE-2026-5631

HIGH

assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection

Title source: cna
STIX 2.1

Description

A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_utils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-355419 | assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection
https://vuldb.com/vuln/355419
Signature, Permissions Required signature permissions-required
VDB-355419 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/355419/cti
Third Party Advisory third-party-advisory
Submit #785858 | assafelovic gpt-researcher 3.4.3 Unauthenticated Remote Code Execution
https://vuldb.com/submit/785858

Scores

CVSS v3 7.3
EPSS 0.0031
EPSS Percentile 22.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-94
Status published
Products (4)
assafelovic/gpt-researcher 3.4.0
assafelovic/gpt-researcher 3.4.1
assafelovic/gpt-researcher 3.4.2
assafelovic/gpt-researcher 3.4.3
Published Apr 06, 2026
Tracked Since Apr 06, 2026