CVE-2026-37006 in gpt-researcher
Summary
by MITRE • 08/27/2026
A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The identified security flaw resides within the WebSocket communication layer of the gpt-researcher software, specifically affecting versions 0.14.7 and earlier releases in this lineage. This vulnerability stems from an insufficient validation mechanism applied to configuration parameters received through the Model Context Protocol (MCP). The MCP is designed to facilitate interaction between large language models and external tools or data sources, but its implementation within gpt-researcher fails to adequately sanitize inputs before they are processed by the underlying system logic. Consequently, this architectural oversight creates a critical attack surface where unauthenticated remote actors can inject malicious payloads directly into the application's execution context via WebSocket connections.
From a technical perspective, the core issue is classified as an improper input validation vulnerability that leads to arbitrary code execution. When a client establishes a WebSocket connection and submits MCP configuration data, the server processes these configurations without rigorous type checking or content filtering. An attacker can craft specific JSON structures containing executable commands or script injections disguised as legitimate configuration directives. Because the system trusts these inputs implicitly due to the lack of authentication requirements on this endpoint, the malicious code is executed with the privileges of the application process. This bypasses traditional network perimeter defenses and allows for direct interaction with the host operating system or internal services depending on how the MCP integrations are configured.
The operational impact of this vulnerability is severe, as it grants an unauthenticated remote attacker full control over the affected instance. Once code execution is achieved, the adversary can perform a wide range of malicious activities including data exfiltration, installation of persistent backdoors, lateral movement within internal networks if accessible services exist, and complete compromise of the host environment. The absence of authentication requirements means that this exploit does not require valid credentials or prior reconnaissance to gain initial access, significantly lowering the barrier for exploitation. This makes it particularly dangerous in public-facing deployments where such endpoints might be inadvertently exposed to the internet without proper access controls.
In terms of industry standard classifications, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-78 OS Command Injection if shell commands are executed directly. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter for initial access or execution, and potentially T1203 Exploitation for Client Execution if the payload targets client-side components via the WebSocket interface. The lack of authentication also relates to CWE-862 Missing Authorization, highlighting a fundamental failure in identity verification before processing sensitive configuration data.
To mitigate this risk immediately, organizations running gpt-researcher versions prior to 0.14.7 must upgrade to the latest patched version where input validation for MCP configurations has been strengthened and authentication requirements have likely been enforced on WebSocket endpoints. If upgrading is not immediately feasible, administrators should implement network-level controls such as firewall rules or reverse proxy configurations that restrict access to the affected WebSocket endpoint exclusively to trusted IP addresses or internal networks. Additionally, deploying a Web Application Firewall with specific rule sets capable of detecting anomalous JSON structures and command injection patterns can provide an additional layer of defense against exploitation attempts while permanent remediation is pursued.