CVE-2025-67743: 
Python vulnerability analysis and mitigation

CVE-2025-67743 is a Server-Side Request Forgery (SSRF) vulnerability in the download service of Local Deep Research, an AI-powered research assistant. Affecting versions 1.3.0 through 1.3.8 (before 1.3.9), the flaw allows authenticated attackers to make the server issue arbitrary HTTP requests to internal network resources and cloud provider metadata endpoints. The vulnerability was published on December 22–23, 2025, and patched in version 1.3.9. It carries a CVSS v3.1 score of 6.3 (Moderate) per the GitHub Advisory, or 6.5 (Medium) per NVD (Github Advisory, Security Advisory).

The root cause (CWE-918) is that download_service.py makes HTTP requests using the raw Python requests.get() function at nine distinct call sites (lines 1038, 1075, 1100, 1144, 1187, 1207, 1236, 1276, and 1298), completely bypassing the application's own SSRF protection layer implemented in security/safe_requests.py and security/ssrf_validator.py. The existing protection blocks loopback addresses (127.0.0.0/8), private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), the AWS metadata endpoint (169.254.169.254), and link-local addresses — but none of these controls apply when download_service.py is invoked. An authenticated attacker submits a malicious URL via POST /api/resources/, which is stored in the database without SSRF validation; triggering a download via /library/api/download/ then causes the server to fetch the attacker-controlled URL using unprotected requests.get() (Security Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to access internal network services (databases, Redis, admin panels), retrieve cloud provider instance metadata (AWS IMDSv2, GCP, Azure), and perform internal network reconnaissance to map topology and identify services not exposed to the internet. The primary impact is high confidentiality loss — sensitive data such as IAM credentials, API keys, and internal service secrets may be exposed. Integrity and availability are not directly affected by this vulnerability (Security Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating successful SSRF against a mock internal service and the AWS metadata endpoint. Exploitation requires low privileges (an authenticated API user) and no user interaction. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.035% (11th percentile), indicating a low near-term exploitation probability. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Security Advisory).

1. Authenticate to the API: Obtain valid credentials for the Local Deep Research instance (versions 1.3.0–1.3.8) and authenticate to acquire a session token.
2. Submit a malicious URL as a resource: Send a POST /api/resources/ request with a body containing a target URL pointing to an internal service (e.g., http://192.168.1.10:6379/ for Redis) or a cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/).
3. Confirm URL is stored: The resource_service.py:add_resource() function stores the URL in the database without SSRF validation, confirming the resource was accepted.
4. Trigger the download: Send a request to /library/api/download/ referencing the newly created resource, causing download_service.py to invoke requests.get(url, ...) directly against the attacker-supplied URL.
5. Retrieve the response: The server returns the response body from the internal target to the attacker, potentially exposing secrets such as database passwords, API keys, IAM credentials, or internal service data (Security Advisory).

• Network: Outbound HTTP requests from the Local Deep Research server process to RFC-1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses, or the AWS/GCP/Azure metadata IP 169.254.169.254; unusual HTTP GET requests to internal hostnames or non-standard ports originating from the application server.
• Logs: Application access logs showing POST /api/resources/ requests with internal or metadata URLs as the resource value; subsequent GET /library/api/download/ requests referencing those resources; Python-level HTTP request logs to internal endpoints.
• File System: No specific file artifacts expected, but review database records in the Local Deep Research data store for resource entries containing internal IP addresses, RFC-1918 ranges, or cloud metadata URLs (Security Advisory).

Upgrade to Local Deep Research version 1.3.9 or later, which replaces all direct requests.get() calls in download_service.py with the SSRF-safe safe_get() wrapper from security/safe_requests.py, covering all nine vulnerable call sites. The patch (commit b79089f) also migrates approximately 40 instances across 19 files, adds a pre-commit hook to block future unsafe requests usage, and adds Semgrep CI enforcement rules. As interim mitigations, implement network-level egress filtering to block outbound connections from the application server to private IP ranges and metadata endpoints, and restrict API access to trusted users only (Patch Commit, Github Advisory).

The vulnerability was reported by researcher yueyueL and published by LearningCircuit on December 22, 2025. The advisory was picked up by standard vulnerability tracking platforms including CIRCL Vulnerability Lookup, ENISA EUVD, Red Hat CVE database, and INCIBE-CERT shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified beyond automated vulnerability feeds (Security Advisory).