PT-2026-44472 · Unknown · Local-Deep-Research

Fushuling + 1 · CVE-2026-46526 · Published 2026-05-28 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions local-deep-research versions prior to 1.6.10

Description A logical flaw in the URL checking logic allows attackers to bypass security filters, leading to Server-Side Request Forgery (SSRF). The software uses the validate url function to perform security checks on the host portion of a URL extracted by urlparse. However, a discrepancy exists between how urlparse and the requests library parse URLs. For example, in the safe get() function, validate url may identify a URL as pointing to a public IP, while requests.get interprets the same URL as pointing to an internal address. This occurs because urlparse may treat certain characters, such as backslashes, as regular characters, whereas requests may treat them as path characters, allowing an attacker to redirect requests to internal network resources.

Recommendations Upgrade to version 1.6.10 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-46526

GHSA-G23J-2VWM-5C25

PYSEC-2026-2611

Affected Products

Local-Deep-Research

References · 16

• 🔥 https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-g23j-2vwm-5c25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46526.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-46526 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46526 · Security Note
• https://osv.dev/vulnerability/GHSA-g23j-2vwm-5c25 · Vendor Advisory
• https://github.com/LearningCircuit/local-deep-research · Note
• https://github.com/LearningCircuit/local-deep-research/releases/tag/v1.6.10 · Note
• https://github.com/LearningCircuit/local-deep-research/pull/3873 · Note
• https://github.com/LearningCircuit/local-deep-research/pull/3882 · Note
• https://github.com/LearningCircuit/local-deep-research/pull/3932 · Note
• https://github.com/LearningCircuit/local-deep-research/pull/3889 · Note
• https://twitter.com/CVEnew/status/2060091962544304158 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1tqerun/resumen_diario_de_vulnerabilidades_28052026 · Reddit Post
• https://pypi.org/project/local-deep-research · Note