gpt-researcher

Critical security vulnerabilities detected: 1. Hardcoded API Key: A Langchain API key (`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`) is hardcoded in `frontend/nextjs/components/Langgraph/Langgraph.js`. This is a severe security risk as it exposes a secret directly in the codebase. 2. Arbitrary Command Execution: The `mcp_configs` (Machine Conversation Protocol configurations) in `backend/server/websocket_manager.py` and `gpt_researcher/mcp/client.py` can define a `command` and `args` to be executed. If these configurations are controllable by untrusted input (e.g., a malicious LLM prompt or external user input), it could lead to arbitrary command execution on the host system where the MCP server is running. 3. File Operations: The server handles file uploads and deletions (`handle_file_upload`, `handle_file_deletion` in `backend/server/server_utils.py`) within the `DOC_PATH`. While `sanitize_filename` helps with filename sanitization, without stringent path validation beyond `os.path.basename`, it could still pose a risk for unintended file manipulation within the designated document path. The project uses various web scraping methods, some of which involve running a full browser instance (Selenium, ZenDriver), increasing the attack surface if the browser or its environment is not properly sandboxed.