PT-2026-30570 · Unknown · Assafelovic Gpt-Researcher

Yu-Bao · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5631

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions assafelovic gpt-researcher versions through 3.4.3

Description A code injection issue exists in the extract command data function within the backend/server/server utils.py file, associated with the ws Endpoint component. Manipulation of the args argument can lead to code injection, potentially allowing remote attacks. The exploit for this issue has been publicly disclosed, and the project maintainers have not yet responded to reports about the problem.

Recommendations Versions prior to 3.4.4 should be updated.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-5631

Affected Products

Assafelovic Gpt-Researcher

References · 11

• 🔥 https://github.com/assafelovic/gpt-researcher/issues/1694 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5631 · Security Note
• https://twitter.com/cyberbivash/status/2041064999775342878 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041054717246120323 · Twitter Post
• https://twitter.com/cyberbivash/status/2041077645614416339 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2041054779745390659 · Twitter Post
• https://twitter.com/CVEnew/status/2041054123739537539 · Twitter Post
• https://vuldb.com/vuln/355419 · Note
• https://github.com/assafelovic/gpt-researcher · Note
• https://vuldb.com/submit/785858 · Note
• https://vuldb.com/vuln/355419/cti · Note