CVE-2026-5633: assafelovic gpt-researcher ws Endpoint server-side request forgery

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-06 · updated 2026-07-24
Weakness: CWE-918

Description

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument source_urls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

assafelovic gpt-researcher: 3.4.0, 3.4.1, 3.4.2, 3.4.3

References

https://github.com/assafelovic/gpt-researcher/
https://github.com/assafelovic/gpt-researcher/issues/1696
https://vuldb.com/submit/785876
https://vuldb.com/vuln/355421
https://vuldb.com/vuln/355421/cti

Get alerted when CVE-2026-5633 or the next vulnerability affects your stack