Critical severity9.8NVD Advisory· Published Aug 27, 2026· Updated Sep 9, 2026

CVE-2026-37006

Description

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

Affected products

Open Source GPT Researcher/gpt-researcherllm-fuzzy
Range: <=0.14.7

Patches

Vulnerability mechanics

References

gpt-researcher.comnvd
yerangamage.com/cves/detail/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000