Is CVE-2026-5631 actively exploited?

No active exploitation of CVE-2026-5631 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-5631 be exploited remotely?

Yes. CVE-2026-5631 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-5631?

CVE-2026-5631 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-5631

HIGH

CVE-2026-5631

CWE-74Published: April 6, 2026· Updated: Apr 7, 2026

7.3

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.4th

Official Description

A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_utils.py of the component ws Endpoint. Such manipulation of the argument args leads to code injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD Source

Technical Analysis

CVE-2026-5631 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.