CVE-2026-37006

Description

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

References

• http://gpt-researcher.com
• https://yerangamage.com/cves/detail/?slug=gptresearcher-websocket-rce