Detections
Analytics
SCA: security update for local-deep-research (GHSA-9c54-gxh7-ppjc)
medium Tenable Cloud Security Plugin ID 436483
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from
1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw
requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow
attackers to access internal services and attempt to reach cloud provider metadata endpoints
(AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through
the API, depending on the deployment and surrounding controls. This issue has been patched in version
1.3.9. (CVE-2025-67743)
See Also
Plugin Details
Severity: Medium
ID: 436483
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 12/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N
CVSS Score Source: CVE-2025-67743
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/23/2025
Vulnerability Publication Date: 12/23/2025
Reference Information
CVE: CVE-2025-67743
cwe: CWE-918