Am I affected by GPT Researcher MCP STDIO configuration allows remote command execution? What should I do?
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.
Affected: gpt-researcher 0.14.5 to 0.14.7. Fixed in: no fix reported yet. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2025-65720-gpt-researcher (opens external site)
1 answer
Am I affected? Affected: gpt-researcher 0.14.5 to 0.14.7. Fixed in: no fix reported yet.
- Check your version: run
pip show gpt-researcher. Versions >= 0.14.5, <= 0.14.7 of gpt-researcher are affected.
What to do now
- No patched version is listed for the affected versions.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-8j86-h8gg-797p (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2025-65720-gpt-researcher (opens external site)
Did this work for you?- Check your version: run