| शीर्षक | assafelovic gpt-researcher 3.4.3 Unrestricted Access |
|---|
| विवरण | gpt-researcher v3.4.3 and earlier versions expose all HTTP REST API endpoints and the WebSocket interface without any form of authentication or authorization. A total of 14 endpoints — including file upload, file deletion, research task generation (which triggers expensive LLM API calls), report access, and chat — are accessible to any unauthenticated network user. This allows an attacker to upload arbitrary files, delete existing files, exfiltrate all research reports, consume API credits by triggering unlimited research tasks, and manipulate server-side configuration. |
|---|
| स्रोत | ⚠️ https://github.com/assafelovic/gpt-researcher/issues/1695 |
|---|
| उपयोगकर्ता | Yu-Bao (UID 96702) |
|---|
| सबमिशन | 23/03/2026 04:11 AM (6 महीनों पहले) |
|---|
| संयम | 05/04/2026 09:12 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355420 [assafelovic gpt-researcher तक 3.4.3 HTTP REST API Endpoint कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|