Skip to content
OpenAdvisories

Package · PyPI

local-deep-research

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.0
    CVE-2026-43979

    Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)

    Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — specifically title (sourced from research.title or resea…

    LearningCircuit local-deep-research local-deep-research PyPI
  • Medium 5.0
    CVE-2026-46526

    Local Deep Research: SSRF bypass in `safe_get`

    Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. The current project uses vali…

    LearningCircuit local-deep-research local-deep-research PyPI
  • Medium 6.3
    CVE-2025-67743

    Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

    Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF prot…

    LearningCircuit local-deep-research local-deep-research PyPI