Code Injection Vulnerability in gpt-researcher by Assafelovic
CVE-2026-5631

6.9MEDIUM

Key Information:

Vendor: Assafelovic
Status: Gpt-researcher
Vendor: CVE Published:; 6 April 2026

🔔 Create Assafelovic Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-5631?

A significant code injection vulnerability has been identified in the gpt-researcher product from Assafelovic, affecting versions up to 3.4.3. This vulnerability exists within the 'extract_command_data' function located in the 'backend/server/server_utils.py' file, specifically in the ws Endpoint component. An attacker can manipulate the 'args' argument to execute arbitrary code remotely. Public disclosure of the exploit has occurred, raising concerns regarding potential unauthorized access and control by malicious actors. Despite being notified early via an issue report, the vendor has yet to respond to this critical issue.

Affected Version(s)

gpt-researcher 3.4.0

gpt-researcher 3.4.1

gpt-researcher 3.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-5631 - Proof of Concept