Description

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T20:17:41.423Z",
  "pubdate": "2026-08-27T20:17:41.423Z",
  "executiveSummary": "The gpt-researcher platform, specifically versions 0.14.7 and earlier, contains a critical vulnerability within its WebSocket endpoint.\nThis vulnerability is classified as an improper input validation flaw, allowing for Remote Code Execution (RCE).\nAn unauthenticated, remote attacker can leverage this flaw by injecting malicious Model Context Protocol (MCP) configurations.\nThe impact of a successful exploitation is severe, granting an attacker the ability to execute arbitrary code with the privileges of the gpt-researcher process.\nThis exposure poses significant risks to system integrity, confidentiality, and availability, as it effectively allows an attacker to bypass authentication mechanisms to interact with the underlying host environment.\nNo specific user interaction is required for the exploit, as the WebSocket endpoint is directly accessible to remote actors, making this a high-risk vulnerability requiring immediate remediation.",
  "technicalDetails": "The vulnerability originates in the processing logic of the WebSocket communication endpoint within gpt-researcher. The system fails to adequately sanitize and validate Model Context Protocol (MCP) configurations passed by a client during the WebSocket session.\nThe root cause is the deserialization or improper handling of configuration data, which is subsequently interpreted or executed by the application backend without sufficient security constraints. This allows an attacker to provide a specially crafted MCP configuration that includes malicious payloads designed to interact with the server's filesystem, environment variables, or system shell.\nThe attack flow begins with an unauthenticated attacker initiating a WebSocket connection to the vulnerable endpoint exposed by gpt-researcher. Once the connection is established, the attacker sends a crafted message containing a malicious MCP configuration payload.\nThe application processes this configuration through its internal handler, which fails to isolate the input from the underlying execution context. Consequently, the payload triggers an execution primitive, allowing the attacker to run system-level commands.\nAffected versions are gpt-researcher v0.14.7 and all preceding versions that utilize this specific WebSocket message handling mechanism. The exploitation is facilitated by the network exposure of the WebSocket interface, which does not enforce authentication before processing the configuration payloads.\nPost-exploitation impact includes full control over the application process. An attacker can leverage this to exfiltrate sensitive data, move laterally within the network, or establish persistent access to the host server. The ability to execute arbitrary code ensures that the attacker can bypass any application-level security controls implemented in later stages of the execution flow."
}