PT-2026-30569 · Assafelovic · Assafelovic Gpt-Researcher

Yu-Bao · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5630

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions assafelovic gpt-researcher versions up to 3.4.3

Description A flaw has been identified in the Report API component of assafelovic gpt-researcher, specifically within the file backend/server/app.py and an unknown function. This issue allows for cross site scripting, potentially exploitable remotely. The exploit has been published.

Recommendations Versions prior to 3.4.4 are recommended.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-5630

Affected Products

Assafelovic Gpt-Researcher

References · 9

• 🔥 https://github.com/assafelovic/gpt-researcher/issues/1693 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5630 · Security Note
• https://twitter.com/infoflowcloud/status/2041054733901680742 · Twitter Post
• https://vuldb.com/vuln/355418 · Note
• https://github.com/assafelovic/gpt-researcher · Note
• https://twitter.com/CVEnew/status/2041054124653924771 · Twitter Post
• https://vuldb.com/vuln/355418/cti · Note
• https://vuldb.com/submit/785856 · Note
• https://twitter.com/cyberbivash/status/2041077647720013911 · Twitter Post