PT-2026-30570 · Unknown · Assafelovic Gpt-Researcher

Yu-Bao · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5631

Positive Technologies · (AI Summary)

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions assafelovic gpt-researcher versions up to 3.4.3

Description A code injection issue exists in the extract command data function within the server utils.py file of the ws Endpoint component. Manipulation of the args argument may lead to code injection, potentially allowing for remote attacks. The exploit for this issue has been publicly disclosed, and the project maintainers have not yet responded to reports.

Recommendations Versions prior to 3.4.3 should be updated.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-5631

Affected Products

Assafelovic Gpt-Researcher

References · 11

• 🔥 https://github.com/assafelovic/gpt-researcher/issues/1694 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5631 · Security Note
• https://twitter.com/infoflowcloud/status/2041054717246120323 · Twitter Post
• https://twitter.com/cyberbivash/status/2041077645614416339 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2041054779745390659 · Twitter Post
• https://vuldb.com/vuln/355419/cti · Note
• https://twitter.com/cyberbivash/status/2041064999775342878 · Twitter Post
• https://vuldb.com/vuln/355419 · Note
• https://vuldb.com/submit/785858 · Note
• https://twitter.com/CVEnew/status/2041054123739537539 · Twitter Post
• https://github.com/assafelovic/gpt-researcher · Note