Executive brief
gpt-researcher is an autonomous AI agent used for conducting deep research. A critical security flaw allows an unauthenticated attacker to remotely execute arbitrary commands on the server hosting the application. This could lead to a total system takeover, theft of sensitive research data, or the use of the server as a foothold for further attacks on the corporate network.
Technical details
A command injection vulnerability exists in the `extract_command_data` function within `backend/server/server_utils.py` of gpt-researcher. The application fails to validate or sanitize the `mcp_configs` parameter received via the unauthenticated `/ws` WebSocket endpoint. An attacker can provide a malicious `command` and `args` array which is eventually passed to `anyio.open_process()` through the Model Context Protocol (MCP) client subsystem. This allows for arbitrary OS command execution with the privileges of the application process. As of the advisory date, the vulnerability remains unpatched.
Affected products
- assafelovic gpt-researcher <= 3.4.3
Timeline
- 2026-03-19: disclosed: Vulnerability discovered and reported via GitHub issue
- 2026-04-06: advisory: Initial disclosure by VulDB/NVD