CVE-2026-76993: GreyDGL PentestGPT Web-Page Crawling injection
A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The reported GitHub issue was closed with the label "not planned".
Affected Software
Event History
Frequently Asked Questions
Which deployments are in scope?
GreyDGL PentestGPT versions up to and including 1.0.0 are reported as affected. The issue is associated with the Web-Page Crawling component.
What does an attacker need to exploit this issue?
The attack can be executed remotely and does not require privileges, but it requires user interaction. Exploitation involves manipulating the Traceback argument and is rated high complexity.
How likely is exploitation in practice?
The report characterizes exploitation as difficult, although a public exploit has been disclosed and may be used. The vulnerability has a medium severity rating with low impacts to confidentiality, integrity, and availability.
Is a remediation or workaround identified?
No patch or workaround is provided in the available information. The referenced GitHub issue was closed with the label "not planned".