CVE-2025-57806
Local Deep Research's API keys are stored in plain text
Impact
**Affected Versions:** > 0.2.0 and < 1.0.0 **Patched Versions:** >= 1.0.0 **Description:** The library stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location. As a result, anyone with access to the container or host filesystem could retrieve sensitive data in plaintext by accessing the `.db` file. **Impact:** Unauthorized access to API keys and other confidential data if the SQLite database file was exposed. **Fixed in Version 1.0.0:** - Database is fully encrypted - Database location is configurable - API keys can be set via environment variables (this capability existed in earlier versions)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | local-deep-research | > 0.2.0, < 1.0.0 | 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://github.com/LearningCircuit/local-deep-research/releases/tag/v1.0.0
- https://github.com/LearningCircuit/local-deep-research/pull/578
- https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-4h8c-qrcq-cv5c
- https://github.com/advisories/GHSA-4h8c-qrcq-cv5c
- https://github.com/LearningCircuit/local-deep-research/commit/5a9af8e6bec2e0fbaaf9810c1398f5b429588243