A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.
CRITICAL
Vulnerability intelligence
CVE-2026-37006
CVSS 3.19.8
SeverityCritical
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database