CVE-2026-5633 Details
Description
A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument source_urls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in Assafelovic GPT Researcher versions through 3.4.3. The issue resides in the WebSocket '/ws' endpoint, where the 'source_urls' parameter is accepted without any validation. This allows attackers to send arbitrary URLs that the server will request, potentially accessing internal services or metadata endpoints. The vulnerability is unauthenticated and the scraped content is returned to the attacker via the research report output, constituting a full-read SSRF.
It is recommended to implement URL validation at the entry point and the scraper initialization to block unauthorized schemes and private IP addresses. This can be done by checking the URL scheme, hostname, and resolving the hostname to ensure it does not point to a private or internal IP.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 6, 2026CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/assafelovic/gpt-researcher/ | [email protected] | ProductSource CodeVendor |
| https://github.com/assafelovic/gpt-researcher/issues/1696 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/785876 | [email protected] | Technical Description |
| https://vuldb.com/vuln/355421 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/355421/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| assafelovic gpt-researcher | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |