CVE-2026-43979: HTML Injection & SSRF in Local Deep Research PDF Export

Technical summary

CVE-2026-43979 is an HTML injection vulnerability in PDFService._markdown_to_html() that occurs when constructing documents for WeasyPrint PDF export. The function interpolates unsanitized user input—specifically research.title, research.query, and metadata key-value pairs—directly into an f-string template without HTML entity encoding. This allows authenticated attackers to inject arbitrary HTML/script content. The injection can be weaponized to bypass ssrf_validator.py protections by embedding SSRF payloads within HTML tags processed during PDF generation, enabling the attacker to trigger server-initiated requests to internal or external resources. The fix in version 1.6.0 implements proper HTML escaping of user-controlled values before document construction.

Business impact

Organizations running Local Deep Research prior to 1.6.0 face confidentiality risks if an attacker gains valid user credentials. A compromised or malicious internal user can abuse PDF export functionality to probe internal network topology, access metadata from internal services, or exfiltrate data through side-channel requests. While the vulnerability requires authentication, insider threats or credential compromise scenarios make this operationally relevant. PDF generation is typically a routine feature, making this vector inconspicuous compared to traditional network-facing exploits.

Affected systems

Local Deep Research versions prior to 1.6.0 are affected. The vulnerability requires an authenticated user account to exploit, limiting exposure to scenarios where credentials are compromised, shared, or held by malicious insiders. Installations running 1.6.0 or later are not vulnerable.

Exploitability

Exploitation requires valid authentication credentials and access to the research creation or query interface. An attacker must craft a specially-formed research query or metadata payload containing HTML special characters (e.g., angle brackets, script tags). The injection is reliable once the attacker initiates PDF export, making reproducibility high in controlled environments. However, real-world exploitation depends on credential availability. No public exploit code or active exploitation in the wild is documented.

Remediation

Upgrade Local Deep Research to version 1.6.0 or later, which patches PDFService._markdown_to_html() to properly escape HTML special characters in user-controlled inputs before document construction. Organizations unable to upgrade immediately should restrict PDF export functionality to trusted users only and monitor for suspicious patterns in generated PDFs or unusual outbound requests from the application server.

Patch guidance

Apply the upgrade to Local Deep Research 1.6.0 as soon as feasible. The patch addresses the root cause by implementing HTML entity encoding on all user-supplied values (title, query, metadata) before insertion into the f-string template. Verify patch deployment by confirming the application version in admin settings or logs, and conduct a brief functional test of PDF export to ensure no side effects. No database migrations or configuration changes are required.

Detection guidance

Monitor application logs for unusual patterns in research queries or metadata submissions containing HTML special characters (<, >, &, quotes, etc.). Track PDF export requests and cross-correlate with subsequent outbound HTTP/HTTPS requests from the application server to internal IP ranges or unexpected external hosts. Network-level detection can flag outbound connections from the application server that deviate from normal behavior. Web application firewalls (WAF) can inspect research query parameters for injected HTML/script tags, though signature-based detection may require tuning.

Why prioritize this

Despite a CVSS score of 5.0 (MEDIUM), this vulnerability warrants timely attention because: (1) it bypasses existing SSRF defenses, indicating a gap in security controls; (2) it leverages a routine feature (PDF export) that users may invoke frequently and without suspicion; (3) insider threats or credential compromise are common attack vectors; and (4) affected organizations may not immediately detect exploitation due to the legitimate-appearing PDF generation activity. Prioritize based on credential exposure risk and internal network sensitivity.

Risk score, explained

CVSS 3.1 score of 5.0 (MEDIUM) reflects: Network attack vector (N) due to remote accessibility of the web application; Low attack complexity (L) because payload construction is straightforward; Low privilege requirement (PR=L) due to authentication; No user interaction (UI=N); Changed scope (S=C) because the SSRF impact can affect other systems; Low confidentiality impact (C=L) from potential unauthorized data access; No integrity or availability impact. The score appropriately reflects the authentication gate and limited confidentiality risk, but does not account for the defense bypass or insider threat context that may elevate practical risk in specific deployments.

Frequently asked questions