TI-2025-41439 Aliases CVE-2025-67743 GHSA-9c54-gxh7-ppjc

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

MEDIUM 62CWE-918Published 2025-12-23 · Updated 2025-12-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00318 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed local-deep-research (LearningCircuit): 1.3.9local-deep-research (PyPI): 1.3.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LearningCircuit	local-deep-research	1.3.0 to before 1.3.9	1.3.9	Patch available	CNA
—	local-deep-research (PyPI)	1.3.0 to before 1.3.9	1.3.9	Patch available	GHSA-9c54-gxh7-ppjc

local-deep-research VendorLearningCircuit Affected 1.3.0 to before 1.3.9 Fixed in 1.3.9 Patch available CNA
local-deep-research (PyPI) Vendor— Affected 1.3.0 to before 1.3.9 Fixed in 1.3.9 Patch available GHSA-9c54-gxh7-ppjc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:learningcircuit:local_deep_research::::::::	1.3.0 to before 1.3.9	Vulnerable	LearningCircuit

cpe:2.3:a:learningcircuit:local_deep_research:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.3.9 Vulnerable ·LearningCircuit

Remediation

Fix · CNA local-deep-research (LearningCircuit) Fixed in 1.3.9
Fix · GHSA-9c54-gxh7-ppjc local-deep-research (PyPI) Fixed in 1.3.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-67743
2026-10-03 Alias added: GHSA-9c54-gxh7-ppjc

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences