Detections
Analytics

SCA: security update for local-deep-research (GHSA-4h8c-qrcq-cv5c)

medium Tenable Self-Hosted Container Security Plugin ID 435169

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0
 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without
 encryption. This behavior was not clearly documented outside of the database architecture page. Users were
 not given the ability to configure the database location, allowing anyone with access to the container or
 host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in
 version 1.0.0. (CVE-2025-57806)

See Also

https://github.com/advisories/GHSA-4h8c-qrcq-cv5c

Plugin Details

Severity: Medium

ID: 435169

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 9/2/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.92

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2025-57806

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/2/2025

Vulnerability Publication Date: 9/2/2025

Reference Information

CVE: CVE-2025-57806

cwe: CWE-312