CVE-2026-37006: gpt-researcher accepted MCP server configs over an unauthenticated WebSocket, spawning attacker-named commands

A CVE record published on 2026-08-27 describes unauthenticated remote code execution in gpt-researcher, the open-source research agent with roughly 29,000 GitHub stars. Per the record, versions 0.14.7 and before accepted "malicious Model Context Protocol configurations" over the backend's WebSocket endpoint. CVE-2026-37006 was assigned by MITRE and had been reserved since 2026-04-06.

Researcher Yeran Gamage's disclosure supplies the mechanism. The /ws endpoint had no authentication gate, and the mcp_configs array in its JSON payload was extracted with plain dictionary lookups rather than schema validation, so the command and args fields of a stdio server entry travelled unchecked into the process spawn that launches MCP servers. One WebSocket message declaring a server whose command was bash executed arbitrary code as the server's user. The researcher rated it CVSS 9.8.

The fix, as the disclosure describes it, shipped in v0.14.8: mandatory authentication on /ws before any payload is processed, a strict Pydantic schema that rejects unexpected fields, and a hardcoded allowlist of permitted executables that rejects shell interpreters. One caution on that version number: it could not be reconciled against the project's own artifacts. The PyPI package's 0.14.8 was uploaded on 2026-03-13, before the disclosure's reported May dates, the GitHub repository carries no v0.14.x tags at all (its releases run v3.5.x and v3.6.x), and no repository security advisory exists. The vulnerability class and the hardening described are well documented in the disclosure; which artifact line carries the fix is not. The check that does not depend on version numbering is behavioral: a patched backend rejects unauthenticated /ws connections before processing any payload.

The pattern is the one this feed keeps recording: an agent backend accepts MCP server configuration over a network interface, and whatever trust that configuration carries flows straight to a subprocess. The MCPHub batch published four days later includes the same shape behind an authenticated endpoint.