CVE-2025-67743 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Attackers can exploit SSRF in the download service to access internal networks and cloud metadata by submitting malicious URLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67743?
CVE-2025-67743 is a medium-severity server-side request forgery vulnerability in LearningCircuit local-deep-research, published on 23 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. This issue has been patched in version 1.3.9.
Weakness: CWE-918
Which versions are affected by CVE-2025-67743?
3 open source packages ship an affected version, including local-deep-research. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
local-deep-research PyPI | From 1.3.0 | 1.3.9 |
local-deep-research PyPI | From 1.3.0 | 1.3.9 |
local-deep-research PyPI | From 1.3.0 | 1.3.9 |
Products include Learningcircuit Local Deep Research.
How do I fix CVE-2025-67743?
Upgrade local-deep-research to 1.3.9 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-67743 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67743 exists.
Sources
Also known as GHSA-9c54-gxh7-ppjc, PYSEC-2026-1581.