PT-2026-30572 · Unknown · Assafelovic Gpt-Researcher

Yu-Bao · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5633

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions assafelovic gpt-researcher versions up to 3.4.3

Description A server-side request forgery condition exists in the ws Endpoint component due to manipulation of the source urls argument. This allows for remote attacks. The issue was reported to the project but has not been addressed. The exploit has been publicly disclosed.

Recommendations Update to a version beyond 3.4.3.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-5633

Affected Products

Assafelovic Gpt-Researcher

References · 9

• 🔥 https://github.com/assafelovic/gpt-researcher/issues/1696 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5633 · Security Note
• https://twitter.com/cyberbivash/status/2041077649313817025 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041054687416197469 · Twitter Post
• https://twitter.com/CVEnew/status/2041054121667567677 · Twitter Post
• https://github.com/assafelovic/gpt-researcher · Note
• https://vuldb.com/submit/785876 · Note
• https://vuldb.com/vuln/355421 · Note
• https://vuldb.com/vuln/355421/cti · Note