Local Deep Research
Approved changes feed: RSS · Atom
cpe:2.3:a:learningcircuit:local_deep_research:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Learningcircuit (c8a942e7-a1f1-5e73-893f-78e79e85d1c1) |
|---|---|
| Product | Local Deep Research (a9f6e73f-7738-5a0c-9864-75a289be2323) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/learningcircuit/local-deep-research |
purl2cpe | 2026-07-28 16:40:52.941072 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-67743 |
vulnerable | 2026-06-08 07:41:20.396848 |
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
MEDIUM (6.3)
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.
Published: 2025-12-23T00:01:19.309Z
Updated: 2025-12-23T15:41:01.533Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.