CVE-2026-37006 – Unauthenticated Remote Code Execution – gpt-researcher ≤ 0.14.7

Summary

CVE-2026-37006 is a critical, unauthenticated remote code execution vulnerability in the WebSocket endpoint of gpt-researcher, an open-source LLM-based autonomous research agent. The flaw allows a remote, unauthenticated attacker to submit a crafted WebSocket message containing a malicious Model Context Protocol (MCP) server configuration, causing the application to spawn an arbitrary OS subprocess. The issue is tracked under CWE-287 (Improper Authentication) and carries a CVSS v3.1 base score of 9.8 (Critical), affecting gpt-researcher versions 0.14.7 and earlier.

Technical details

• Root cause: The /ws WebSocket endpoint performs no authentication, and incoming MCP configuration payloads are parsed via unsafe dictionary .get() lookups rather than strict schema (Pydantic) validation. This allows attacker-controlled command and args fields in a mcp_configs entry (using connection_type: "stdio") to flow, unsanitized, directly into a subprocess execution call.
• Trigger conditions: No authentication, session, or user interaction is required. An attacker only needs network access to the exposed WebSocket endpoint.
• Attack vector: Network — the attacker sends a single WebSocket message such as a task request with mcp_enabled: true and an mcp_configs array specifying an arbitrary executable (e.g., bash) and arguments.
• Impact: Full remote code execution as the user running the gpt-researcher server process, with no privilege or interaction barriers. Depending on the host’s local privilege configuration (e.g., membership in sudo or docker groups), this can lead to complete host or container compromise, and provides an attacker with confidentiality, integrity, and availability impact — matching the CVSS impact metrics (C:H/I:H/A:H).

Affected software

• gpt-researcher (assafelovic/gpt-researcher) versions 0.14.7 and all prior versions

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network | Attack Complexity: Low | Privileges Required: None | User Interaction: None | Scope: Unchanged | Confidentiality/Integrity/Availability Impact: High

Mitigation and recommended actions

• Immediate: Upgrade gpt-researcher to version 0.14.8 or later, which introduces mandatory session-token authentication on the WebSocket endpoint before any payload is processed, replaces unsafe dictionary-based parsing with strict schema validation, and enforces an allowlist of safe executables while rejecting shell interpreters for MCP stdio connections.
• If immediate patching is not possible:
  • Do not expose the gpt-researcher WebSocket endpoint (/ws) directly to the internet; restrict access to trusted internal networks only, via firewall rules or a reverse proxy requiring authentication.
  • Disable or restrict MCP integration (mcp_enabled) if it is not required for your deployment.
  • Monitor for unexpected outbound connections or child processes spawned by the gpt-researcher service, which may indicate exploitation attempts.
  • Run the gpt-researcher service under a low-privilege account that is not a member of sudo, docker, or other privileged groups, to limit blast radius if exploited.

References

• CVE-2026-37006 Record (CVE Program)
• gpt-researcher GitHub Repository
• Vulnerability Write-up: gpt-researcher WebSocket RCE