CVE-2026-5633

CVE-2026-5633 is a server-side request forgery (SSRF) vulnerability in GPT-Researcher versions up to 3.4.3, where manipulation of the source_urls parameter in the WebSocket endpoint allows attackers to forge server requests. The vulnerability affects the ws Endpoint component through an unknown function and can be triggered remotely without authentication or user interaction. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector, low complexity, and no privilege or user interaction requirements. Exploitation could result in limited impacts to confidentiality, integrity, and availability. The EPSS score of 0.0005 indicates this vulnerability is currently not widely exploited in the wild relative to other disclosed CVEs. The exploit code has been publicly disclosed and is theoretically available for use. However, exploitation appears inactive in observed threat landscapes, as indicated by its absence from CISA's Known Exploited Vulnerabilities (KEV) catalog and inactive status on industry hot lists. The vendor was notified through an issue report but has not yet responded, leaving this vulnerability unpatched in current releases.