| शीर्षक | assafelovic gpt-researcher 3.4.3 Stored Cross-Site Scripting (XSS) |
|---|
| विवरण | GPT Researcher v3.4.3 and earlier versions are vulnerable to Stored Cross-Site Scripting (XSS) through the unauthenticated Report API. An attacker can inject arbitrary HTML and JavaScript into research reports via `POST /api/reports` or `PUT /api/reports/{id}` without authentication. The injected payload is stored server-side and rendered unsanitized in the NextJS frontend when any user navigates to the report URL (`/research/{id}`). The NextJS frontend uses `remark-html` with `sanitize: false` and renders the output via React's `dangerouslySetInnerHTML`, executing the attacker's JavaScript in the victim's browser. |
|---|
| स्रोत | ⚠️ https://github.com/assafelovic/gpt-researcher/issues/1693 |
|---|
| उपयोगकर्ता | Yu-Bao (UID 96702) |
|---|
| सबमिशन | 23/03/2026 03:23 AM (6 महीनों पहले) |
|---|
| संयम | 05/04/2026 09:12 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355418 [assafelovic gpt-researcher तक 3.4.3 Report API backend/server/app.py क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|