Detections
Analytics

SCA: security update for local-deep-research (GHSA-g23j-2vwm-5c25)

medium Tenable Self-Hosted Container Security Plugin ID 442446

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the
 URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading
 to SSRF attacks. The current project uses validate_url to validate the input URL. The main logic is to
 perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks.
 However, there are indeed differences in parsing between urlparse and the library that actually sends the
 request. For example, in safe_get, validate_url is first used to perform an SSRF check, and then
 requests.get is used to send the actual request. This vulnerability is fixed in 1.6.10. (CVE-2026-46526)

Solution

Update the local-deep-research library and its related packages to version 1.6.10 or later.

See Also

https://github.com/advisories/GHSA-g23j-2vwm-5c25

Plugin Details

Severity: Medium

ID: 442446

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 5/29/2026

Updated: 6/19/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2026-46526

CVSS v3

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2026

Vulnerability Publication Date: 5/28/2026

Reference Information

CVE: CVE-2026-46526

cwe: CWE-918