{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.14.5","last_affected":"0.14.7"}],"component":"gpt-researcher","cve_ids":["CVE-2025-65720"],"ecosystem":"PyPI","epss":0.00722,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8j86-h8gg-797p","id":"tcs_01M5KHAP1B3YFNN4DWHPKC9J6K","modified_at":"2026-10-15T14:45:05.906144331Z","published_at":"2026-10-15T10:22:43.607342Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4219","https://nvd.nist.gov/vuln/detail/CVE-2025-65720","https://github.com/assafelovic/gpt-researcher","https://www.ox.security/blog/gpt-researcher-remote-code-execution","https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem","https://pypi.org/project/gpt-researcher","https://github.com/advisories/GHSA-8j86-h8gg-797p"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-4219","url":"https://osv.dev/vulnerability/PYSEC-2026-4219"}],"summary":"GPT Researcher MCP STDIO configuration allows remote command execution"}