CVE-2026-46526: local-deep-research has an SSRF bypass in `safe_get`
(updated )
The URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.
References
- github.com/LearningCircuit/local-deep-research/pull/3873
- github.com/LearningCircuit/local-deep-research/pull/3882
- github.com/LearningCircuit/local-deep-research/pull/3889
- github.com/LearningCircuit/local-deep-research/pull/3932
- github.com/LearningCircuit/local-deep-research/releases/tag/v1.6.10
- github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-g23j-2vwm-5c25
- github.com/advisories/GHSA-g23j-2vwm-5c25
- nvd.nist.gov/vuln/detail/CVE-2026-46526
Code Behaviors & Features
Detect and mitigate CVE-2026-46526 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →