Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Description
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
local-deep-researchPyPI | >= 1.3.0, < 1.3.9 | 1.3.9 |
Affected products
2- Range: v1.3.0, v1.3.1, v1.3.2, …
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-9c54-gxh7-ppjcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-67743ghsaADVISORY
- github.com/LearningCircuit/local-deep-research/commit/b79089ff30c5d9ae77e6b903c408e1c26ad5c055ghsax_refsource_MISCWEB
- github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-9c54-gxh7-ppjcghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.