gpt-researcher WebSocket Unauthenticated RCE via Malicious MCP Configuration

Technical Analysis

The WebSocket endpoint in gpt-researcher accepts MCP configuration data from clients without authenticating the sender or adequately validating the configuration content. An attacker can craft an MCP configuration payload (e.g., specifying malicious server commands, arguments, or connection parameters) that, when processed by the application's MCP client integration, results in arbitrary code execution on the host running gpt-researcher. This crosses the trust boundary between the untrusted network client and the backend agent process, since MCP configurations are typically expected to originate from trusted local/administrator sources rather than arbitrary remote WebSocket clients. Successful exploitation gives the attacker code execution in the context of the gpt-researcher server process, potentially enabling further lateral movement, data exfiltration, or full host compromise.

Affected Systems

gpt-researcher; protocols: MCP

Detection Signatures

• Unexpected or unauthenticated WebSocket connections to gpt-researcher MCP configuration endpoints
• MCP configuration payloads containing unexpected executable commands, shell metacharacters, or unusual server command/argument fields
• Anomalous child process spawning by the gpt-researcher server process shortly after WebSocket configuration messages
• Repeated WebSocket connection attempts from external/untrusted IPs to the MCP config endpoint

Remediation Steps

1. 1

   Upgrade gpt-researcher

   Update to a patched version of gpt-researcher beyond v0.14.7 once available that addresses this CVE.

2. 2

   Authenticate WebSocket endpoints

   Require authentication and authorization on all WebSocket endpoints that accept MCP configuration or control messages, rejecting unauthenticated connections.

3. 3

   Validate and sandbox MCP configurations

   Implement strict schema validation and allow-listing for MCP server configurations; run MCP server processes in a sandboxed, least-privilege environment.

4. 4

   Network segmentation

   Restrict network exposure of the gpt-researcher WebSocket endpoint to trusted internal networks or via VPN/firewall rules until patched.

5. 5

   Monitor and alert

   Deploy logging and alerting on MCP configuration changes and unexpected process execution from the gpt-researcher service.