| शीर्षक | assafelovic gpt-researcher 3.4.3 Reflected Cross-Site Scripting (XSS) |
|---|
| विवरण | GPT Researcher v3.4.3 and earlier versions are vulnerable to Reflected Cross-Site Scripting (XSS) via the research task name. When a user submits a research query containing HTML/JavaScript through the WebSocket interface, the backend includes the unsanitized task name in multiple WebSocket logs response messages. The lightweight frontend renders these log messages using innerHTML without any sanitization, causing the injected script to execute in the user's browser. No authentication is required to trigger this vulnerability. |
|---|
| स्रोत | ⚠️ https://github.com/assafelovic/gpt-researcher/issues/1692 |
|---|
| उपयोगकर्ता | Yu_Bao (UID 89348) |
|---|
| सबमिशन | 23/03/2026 02:12 AM (7 महीनों पहले) |
|---|
| संयम | 05/04/2026 06:56 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355415 [assafelovic gpt-researcher तक 3.4.3 WebSocket Interface researcher.py task क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|