CVE-2025-67743
Description
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
local-deep-researchPyPI | >= 1.3.0, < 1.3.9 | 1.3.9 |
Affected products
3v1.3.0, v1.3.1, v1.3.2, …+ 1 more
- (no CPE)range: v1.3.0, v1.3.1, v1.3.2, …
- cpe:2.3:a:learningcircuit:local_deep_research:*:*:*:*:*:*:*:*range: >=1.3.0,<1.3.9
Patches
Vulnerability mechanics
References
4- github.com/LearningCircuit/local-deep-research/commit/b79089ff30c5d9ae77e6b903c408e1c26ad5c055nvdPatchWEB
- github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-9c54-gxh7-ppjcnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-9c54-gxh7-ppjcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-67743ghsaADVISORY
News mentions
0No linked articles in our index yet.