GHSA-43px-gpwc-q84v

Source

https://github.com/advisories/GHSA-43px-gpwc-q84v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-43px-gpwc-q84v/GHSA-43px-gpwc-q84v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-43px-gpwc-q84v

Aliases

Published

2026-06-08T00:30:25Z

Modified

2026-08-04T14:40:42Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

zilliztech deep-searcher has an Incorrect Privilege Assignment issue

Details

A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collection_router.py. This manipulation of the argument kwargs causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Database specific

{
    "cwe_ids": [
        "CWE-266"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T20:54:22Z",
    "nvd_published_at": "2026-06-07T23:16:42Z",
    "severity": "LOW"
}

References

Affected packages

PyPI / deepsearcher

Package

Name: deepsearcher; View open source insights on deps.dev
Purl: pkg:pypi/deepsearcher

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.0.2

Affected versions

0.*

0.0.1rc1

0.0.1rc2

0.0.1rc3

0.0.1

0.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-43px-gpwc-q84v/GHSA-43px-gpwc-q84v.json"