Executive brief
A vulnerability in the PDF export feature of local-deep-research allows authenticated users to inject malicious code into generated documents. This can be used to force the server to make unauthorized requests to internal services or cloud metadata endpoints, potentially exposing sensitive credentials or internal network information. The issue affects any deployment where users can generate PDF reports from their research queries.
Technical details
The vulnerability exists in `PDFService._markdown_to_html()` within `pdf_service.py`, where user-controlled research titles and metadata are interpolated into HTML f-strings without escaping. An authenticated attacker can submit a research query containing HTML tags (e.g., `</title><img src="...">`) which are then rendered by the WeasyPrint engine during PDF export. This allows for SSRF, enabling the attacker to bypass existing `ssrf_validator.py` protections because WeasyPrint's internal resource fetching does not use the application's validator. Attackers can target cloud metadata services (169.254.169.254) or internal network resources. The issue is patched in version 1.6.0 by implementing `html.escape()` and a custom `url_fetcher` for WeasyPrint.
Affected products
- LearningCircuit local-deep-research < 1.6.0
Timeline
- 2026-03-29: patched: Initial HTML injection fix in v1.5.0
- 2026-04-24: patched: Full SSRF mitigation in v1.6.0
- 2026-05-11: disclosed