CVE-2025-65720

critical

Description

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

References

References
More

https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html

https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/

https://github.com/studiomeyer-io/mcp-armor

https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/

https://www.ox.security/blog/gpt-researcher-remote-code-execution

https://github.com/assafelovic/gpt-researcher

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210474

Details

Source: Mitre, NVD

Published: 2026-07-15

Updated: 2026-10-06

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H