Unknown nvd · CVE-2026-37006

CVE-2026-37006: A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker

Published Aug 27, 2026

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

Agentic / MCP

Affected AI Products

model context protocol

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.