5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43979

CVE-2026-43979: Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)

Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — specifically title (sourced from research.title or research.query) and metadata key-value pairs — directly into an f-string without any HTML escaping. An authenticated attacker can craft a research query containing HTML special characters to inject arbitrary HTML tags into the document processed by WeasyPrint during PDF export. This injection can be chained to trigger a Server-Side Request Forgery (SSRF), bypassing the application's existing SSRF defenses in ssrf_validator.py. This vulnerability is fixed in 1.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43979

CVE-2026-43979:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
local-deep-research	pip	< 1.6.0	1.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an HTML injection in the PDF export functionality of the local-deep-research application, which can be chained to achieve Server-Side Request Forgery (SSRF). The core of the vulnerability lies in the PDFService._markdown_to_html function, where user-controlled input (title and metadata) is used to construct an HTML document without proper sanitization or escaping. This allows an attacker to inject arbitrary HTML tags.

The injected HTML is then processed by the WeasyPrint library within the PDFService.markdown_to_pdf function. In its vulnerable state, this function did not restrict WeasyPrint's ability to fetch external resources. Consequently, an attacker could inject an <img> or <link> tag with a src or href attribute pointing to an internal network address. When WeasyPrint renders the PDF, it makes a request to this internal address on behalf of the server, leading to SSRF. This could allow an attacker to access cloud provider metadata services, internal APIs, or other sensitive resources.

The remediation was applied in two stages. First, the HTML injection was fixed in _markdown_to_html by applying html.escape() to the user-provided data. Second, as a defense-in-depth measure, markdown_to_pdf was updated to use a custom url_fetcher that validates and blocks requests to internal or unsafe URLs, preventing the SSRF vector.

Vulnerable functions

PDFService._markdown_to_html

src/local_deep_research/web/services/pdf_service.py

This function constructs an HTML document by directly embedding the `title` and `metadata` values from user input into an f-string without any HTML escaping. An attacker can provide a malicious string with HTML tags, which are then rendered as part of the document, leading to HTML injection. This is the root cause of the vulnerability.

PDFService.markdown_to_pdf

src/local_deep_research/web/services/pdf_service.py

This function takes the HTML generated by `_markdown_to_html` and uses the WeasyPrint library to convert it to a PDF. The vulnerable version of this function did not configure a custom `url_fetcher`, causing WeasyPrint to fetch any URL referenced in the HTML. When combined with the HTML injection in `_markdown_to_html`, this allows an attacker to inject tags like `<img src=...>` pointing to internal services, thus triggering a Server-Side Request Forgery (SSRF). The patch mitigates this by adding a `_safe_url_fetcher` that validates URLs before fetching.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.