PT-2025-52729 · Pypi+1 · Requests+1

Yueyuel · Published 2025-12-23 · Updated 2025-12-23 · CVE-2025-67743

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Local Deep Research versions 1.3.0 through 1.3.8

Description The software is an AI-powered research assistant. A flaw exists in the download service (download service.py) where HTTP requests are made using raw requests.get() calls, bypassing the application’s Server-Side Request Forgery (SSRF) protection (safe requests.py). This allows attackers to potentially access internal services and cloud provider metadata endpoints (AWS/GCP/Azure), and conduct internal network reconnaissance by submitting malicious URLs through the API. The API is susceptible to malicious URLs.

Recommendations Update to version 1.3.9 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-67743

GHSA-9C54-GXH7-PPJC

Affected Products

Local-Deep-Research

Requests

References · 9

• 🔥 https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-9c54-gxh7-ppjc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67743.json · Exploit
• https://github.com/LearningCircuit/local-deep-research/commit/b79089ff30c5d9ae77e6b903c408e1c26ad5c055 · Patch
• https://osv.dev/vulnerability/CVE-2025-67743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67743 · Security Note
• https://t.me/cveNotify/146629 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2003342109034574282 · Twitter Post
• https://twitter.com/CVEnew/status/2003272594431312151 · Twitter Post
• https://t.me/CVEtracker/40461 · Telegram Post