Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Description
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
local-deep-researchPyPI | >= 1.3.0, < 1.3.9 | 1.3.9 |
Affected products
1- Range: v1.3.0, v1.3.1, v1.3.2, …
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-9c54-gxh7-ppjcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-67743ghsaADVISORY
- github.com/LearningCircuit/local-deep-research/commit/b79089ff30c5d9ae77e6b903c408e1c26ad5c055ghsax_refsource_MISCWEB
- github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-9c54-gxh7-ppjcghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.