An unauthenticated remote code execution vulnerability in GPT Researcher allows attackers to execute arbitrary commands on the host server by injecting malicious configuration data via WebSocket messages.

The flaw resides in the handling of MCP (Model Context Protocol) configurations within the WebSocket /ws endpoint. An unauthenticated attacker can supply a crafted mcp_configs object, which is processed by the application without sanitization and passed to anyio.open_process(), resulting in arbitrary OS command execution.

Successful exploitation grants an attacker full control over the server process, enabling unauthorized data access, system modification, or the installation of persistent backdoors. Given that this vulnerability requires no authentication and allows for remote code execution, the business risk is severe. While the CVSS score is 7.3, the potential for full system compromise and the lack of authentication mechanisms make this a critical priority for remediation.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the WebSocket endpoint to trusted IP addresses only. If possible, disable the MCP (Model Context Protocol) functionality within the application configuration until an update is released.

Proactive Monitoring: Monitor server logs for unexpected WebSocket connection patterns or the execution of unauthorized subprocesses. Review process activity logs for the application user to identify attempts to spawn shells or interact with sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) or a reverse proxy to intercept and block incoming WebSocket traffic containing suspicious mcp_configs payloads. Ensure that the application runs with the least privilege necessary to limit the impact of potential command execution.

Public Exploit Available: Yes, a proof-of-concept demonstrating remote code execution has been published in the official project issue tracker.

Given the availability of a public proof-of-concept and the trivial nature of the exploit, users should treat this as a critical security event. Immediate network-level isolation of the vulnerable service is required to prevent unauthorized access. Monitor the upstream GitHub repository for official release updates and apply the vendor patch immediately upon availability.