CVE-2026-5630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5630", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-05T19:12:39.573Z", "datePublished": "2026-04-06T06:15:12.592Z", "dateUpdated": "2026-04-06T14:55:58.182Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T06:15:12.592Z"}, "title": "assafelovic gpt-researcher Report API app.py cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "assafelovic", "product": "gpt-researcher", "versions": [{"version": "3.4.0", "status": "affected"}, {"version": "3.4.1", "status": "affected"}, {"version": "3.4.2", "status": "affected"}, {"version": "3.4.3", "status": "affected"}], "modules": ["Report API"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-05T21:17:54.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yu-Bao (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355418", "name": "VDB-355418 | assafelovic gpt-researcher Report API app.py cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355418/cti", "name": "VDB-355418 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785856", "name": "Submit #785856 | assafelovic gpt-researcher 3.4.3 Stored Cross-Site Scripting (XSS)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/assafelovic/gpt-researcher/issues/1693", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/assafelovic/gpt-researcher/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T14:55:44.794453Z", "id": "CVE-2026-5630", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:55:58.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5630", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T14:55:44.794453Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:55:49.170Z"}}], "cna": {"title": "assafelovic gpt-researcher Report API app.py cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "Yu-Bao (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "assafelovic", "modules": ["Report API"], "product": "gpt-researcher", "versions": [{"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.4.1"}, {"status": "affected", "version": "3.4.2"}, {"status": "affected", "version": "3.4.3"}]}], "timeline": [{"lang": "en", "time": "2026-04-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-05T21:17:54.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355418", "name": "VDB-355418 | assafelovic gpt-researcher Report API app.py cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355418/cti", "name": "VDB-355418 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785856", "name": "Submit #785856 | assafelovic gpt-researcher 3.4.3 Stored Cross-Site Scripting (XSS)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/assafelovic/gpt-researcher/issues/1693", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/assafelovic/gpt-researcher/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T06:15:12.592Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5630", "state": "PUBLISHED", "dateUpdated": "2026-04-06T14:55:58.182Z", "dateReserved": "2026-04-05T19:12:39.573Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-06T06:15:12.592Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Report API"], "product": "gpt-researcher", "vendor": "assafelovic", "versions": [{"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.4.1"}, {"status": "affected", "version": "3.4.2"}, {"status": "affected", "version": "3.4.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en assafelovic gpt-researcher hasta la versi\u00f3n 3.4.3. El elemento afectado es una funci\u00f3n desconocida del archivo backend/server/app.py del componente Report API. Esta manipulaci\u00f3n provoca cross-site scripting. El ataque puede ser llevado a cabo remotamente. El exploit ha sido publicado y puede ser utilizado. El proyecto fue notificado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-5630", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5630", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T14:55:44.794453Z", "version": "2.0.3"}}]}, "published": "2026-04-06T07:16:01.757", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/assafelovic/gpt-researcher/"}, {"source": "cna@vuldb.com", "url": "https://github.com/assafelovic/gpt-researcher/issues/1693"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/785856"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355418"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355418/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gpt-researcher", "source": "cna", "vendor": "assafelovic"}, "product": "gpt-researcher", "vendor": "assafelovic"}], "analysis": {"en": {"generated_at": "2026-04-06T10:21:43.105912+00:00", "value": {"mitigation_remediation": ["Upgrade gpt\u2011researcher to a version newer than 3.4.3 once the maintainer releases a patch.", "If a newer release is not yet available, monitor the project's GitHub issues (e.g., issue #1693) for a fix or update notification.", "Restrict or sanitize input to the Report API endpoint to eliminate the possibility of injecting malicious script, ensuring proper output encoding.", "If the Report API is not essential for your deployment, consider disabling or removing that endpoint until a fix is applied.", "Perform a code review of the backend/server/app.py function that is impacted and audit for other potential injection points."], "summary": {"action": "Assess Impact", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the gpt\u2011researcher application maintained by the user assafelovic, specifically the Report API logic in backend/server/app.py. All releases from the initial release through 3.4.3 are affected. The repository is hosted on GitHub and users can download the source or clone the project from https://github.com/assafelovic/gpt\u2011researcher.", "description_and_impact": "The gpt\u2011researcher project contains a cross\u2011site scripting flaw in the Report API endpoint in the backend/server/app.py component, active in all releases up to 3.4.3. The flaw allows remote attackers to inject malicious JavaScript that runs in the context of the victim\u2019s browser when the report page is rendered, potentially stealing session cookies, hijacking accounts, or executing additional client\u2011side code. This issue is classified as CWE\u201179 and involves code execution paths identified as CWE\u201194. The impact is the loss of confidentiality and integrity of user data and the possibility of executing arbitrary client\u2011side code on users\u2019 machines.", "risk_and_exploitability": "The CVSS v3 score of 5.3 indicates a moderate risk, and the EPSS score is not available, so the exact likelihood cannot be quantified. The vulnerability is exploitable remotely, and published exploit scripts are available on GitHub and other vulnerability databases, making it a realistic threat. The issue is not currently listed in the CISA KEV catalog, but the existence of a publicly available exploit increases the urgency. Attackers can trigger the flaw by sending crafted requests to the Report API endpoint, and the resulting XSS can be used to steal session cookies or deliver further malicious payloads to unsuspecting users."}}}}, "created": "2026-04-06T20:15:02.178216+00:00", "updated": "2026-04-06T21:47:19.007984+00:00", "vendors": ["assafelovic", "assafelovic$PRODUCT$gpt-researcher"]}