Most recent entries from all

EUVD-2026-264296

fkie_cve-2025-67743

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.

GHSA-9c54-gxh7-ppjc — Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Affected: PyPI: local-deep-research

## Summary

The download service (`download_service.py`) makes HTTP requests using raw `requests.get()` without utilizing the application's SSRF protection (`safe_requests.py`). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls.

**CWE**: CWE-918 (Server-Side Request Forgery)

---

## Details

### Vulnerable Code Location

**File**: `src/local_deep_research/research_library/services/download_service.py`

The application has proper SSRF protection implemented in `security/safe_requests.py` and `security/ssrf_validator.py`, which blocks: - Loopback addresses (127.0.0.0/8) - Private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) - AWS metadata endpoint (169.254.169.254) - Link-local addresses

However, `download_service.py` bypasses this protection by using raw `requests.get()` directly:

```python # Line 1038 - _download_generic method response = requests.get(url, headers=headers, timeout=30)

# Line 1075 response = requests.get(api_url, timeout=10)

# Line 1100 pdf_response = requests.get(pdf_url, headers=headers, timeout=30)

# Line 1144 response = requests.get(europe_url, headers=headers, timeout=30)

# Line 1187 api_response = requests.get(elink_url, params=params, timeout=10)

# Line 1207 summary_response = requests.get(esummary_url, ...)

# L…

PYSEC-2026-1581 — Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service