A vulnerability was identified in the WebSocket interface component of the GPT‑Researcher project. The flaw resides in the researcher.py file, where the task argument is processed without adequate validation. This issue permits an attacker to inject arbitrary script code, leading to cross‑site scripting (XSS) that can execute client‑side code, potentially stealing credentials or hijacking sessions. The weakness is categorized as CWE‑79, indicating improper input handling for web content, and also involves dynamic code execution as described by CWE‑94.

The vulnerability affects all releases of the GPT‑Researcher project up to and including version 3.4.3. The affected product is the WebSocket interface provided by the open‑source project maintained by “assafelovic.” No specific vendor or product name beyond the open‑source repository is listed, and affected versions are identified by the project's release history.

The CVSS score of 5.3 reflects moderate severity, but the vulnerability can be leveraged remotely and the exploit code is publicly available. While the EPSS score is not provided, the public availability of the exploit and the lack of an official patch suggest a non‑negligible risk. Attackers could target any exposed WebSocket endpoint to send a crafted task argument, triggering the XSS payload in connected clients. The vulnerability has not been added to the CISA KEV catalog, but the lack of patching implies that organizations using the affected commands should act promptly.