Skip to content
OpenAdvisories

Vendor

LearningCircuit

4 known vulnerabilities.

Products

local-deep-research 4
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-43979

    Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)

    Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — specifically title (sourced from research.title or resea…

    LearningCircuit local-deep-research local-deep-research PyPI
  • Medium 5.0
    CVE-2026-46526

    Local Deep Research: SSRF bypass in `safe_get`

    Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. The current project uses vali…

    LearningCircuit local-deep-research local-deep-research PyPI
  • Medium 6.3
    CVE-2025-67743

    Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

    Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF prot…

    LearningCircuit local-deep-research local-deep-research PyPI
  • Medium 6.9
    CVE-2025-57806

    Local Deep Research's API keys are stored in plain text

    Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented out…

    LearningCircuit local-deep-research