Is CVE-2026-43979 actively exploited?

No active exploitation of CVE-2026-43979 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43979 be exploited remotely?

Yes. CVE-2026-43979 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-43979?

CVE-2026-43979 has a CVSS score of 5.0 (MEDIUM).

HOME VULNERABILITIESCVE-2026-43979

MEDIUM

CVE-2026-43979

CWE-79Published: May 28, 2026· Updated: Jun 1, 2026

5.0

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.9th

Official Description

Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — specifically title (sourced from research.title or research.query) and metadata key-value pairs — directly into an f-string without any HTML escaping. An authenticated attacker can craft a research query containing HTML special characters to inject arbitrary HTML tags into the document processed by WeasyPrint during PDF export. This injection can be chained to trigger a Server-Side Request Forgery (SSRF), bypassing the application's existing SSRF defenses in ssrf_validator.py. This vulnerability is fixed in 1.6.0.

NVD Source

Technical Analysis

CVE-2026-43979 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.