PT-2025-35648 · Unknown · Local-Deep-Research

I-D-Lytvynenko · Published 2025-09-03 · Updated 2025-09-03 · CVE-2025-57806

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Local Deep Research versions 0.2.0 through 0.6.7

Description Local Deep Research stores confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file.

Recommendations Update to version 1.0.0.

Exploit

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

CVE-2025-57806

GHSA-4H8C-QRCQ-CV5C

Affected Products

Local-Deep-Research

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57806.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-57806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57806 · Security Note
• https://github.com/LearningCircuit/local-deep-research/pull/578 · Note
• https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-4h8c-qrcq-cv5c · Note
• https://t.me/CVEtracker/31542 · Telegram Post
• http://github.com/LearningCircuit/local-deep-research/releases/tag/v1.0.0 · Note
• https://twitter.com/VulmonFeeds/status/1963149360255930681 · Twitter Post
• https://twitter.com/CVEnew/status/1963064983769477605 · Twitter Post