Local Deep Research Vulnerability in AI-Powered Research Assistant from LearningCircuit
CVE-2025-67743
What is CVE-2025-67743?
The Local Deep Research application, utilized for AI-driven research tasks, has a vulnerability in versions 1.3.0 to 1.3.8. The download service, found in download_service.py, directly executes HTTP requests without implementing necessary SSRF protections present in safe_requests.py. This oversight permits attackers to exploit the application by manipulating the API to interact with internal services and potentially access cloud provider metadata endpoints across platforms like AWS, GCP, or Azure. Consequently, attackers can conduct internal network reconnaissance, contingent on the deployment environment and its security configurations. A fix has been released in version 1.3.9 to address this issue.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
local-deep-research >= 1.3.0, < 1.3.9
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved