CVE-2025-57806

Local Deep Research's API keys are stored in plain text

State: Published
Severity: 6.9 Medium
Published: Sep 3, 2025
Updated: Sep 3, 2025
Reserved: Aug 20, 2025

Description

Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information
CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
local-deep-researchLearningCircuit	>= 0.2.0, < 1.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.