Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.
References
Configurations
History
29 Dec 2025, 16:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:learningcircuit:local_deep_research:*:*:*:*:*:*:*:* | |
| First Time |
Learningcircuit
Learningcircuit local Deep Research |
|
| References | () https://github.com/LearningCircuit/local-deep-research/commit/b79089ff30c5d9ae77e6b903c408e1c26ad5c055 - Patch | |
| References | () https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-9c54-gxh7-ppjc - Exploit, Vendor Advisory |
23 Dec 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-9c54-gxh7-ppjc - |
23 Dec 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-23 01:15
Updated : 2025-12-29 16:08
NVD link : CVE-2025-67743
Mitre link : CVE-2025-67743
CVE.ORG link : CVE-2025-67743
JSON object : View
Products Affected
learningcircuit
- local_deep_research
CWE
CWE-918
Server-Side Request Forgery (SSRF)