CVE-2026-85694 in LaVague
Summary
by MITRE • 09/04/2026
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in LaVague version 0.2.35 represents a critical security flaw within its core data extraction functionality, specifically located in the PythonFromMarkdownExtractor.extract_as_object method. This component is designed to parse markdown-formatted content and convert it into structured objects for further processing by large language models or downstream applications. The fundamental issue arises from the system's trust model regarding untrusted input derived from external web sources. When the extractor processes text that has been generated or influenced by a language model, it fails to adequately sanitize or validate the resulting output before attempting to evaluate it as Python code. This creates a direct pathway for remote code execution if an attacker can manipulate the content of a targeted web page.
The attack vector relies on indirect prompt injection techniques rather than traditional buffer overflows or syntax errors. An adversary targets a specific website and injects malicious instructions into its visible or hidden text fields, meta tags, or other accessible areas. When LaVague crawls this webpage to extract information, the language model processes the injected content as part of its context window. Due to the nature of large language models, which are designed to follow instructions and generate coherent responses based on their input, the model may output Python code snippets that appear legitimate but contain harmful payloads. Because LaVague's extractor treats this output as executable code without sufficient verification, it proceeds to evaluate these strings directly within its runtime environment.
This lack of validation allows an attacker to achieve arbitrary command execution on the host machine running the LaVague instance. The operational impact is severe, potentially leading to full system compromise, data exfiltration, or lateral movement within a network if the affected server has broader access privileges. Unlike direct injection where the user explicitly provides malicious input, indirect prompt injection exploits the trust relationship between the application and its content sources. This makes detection significantly more difficult because the malicious code is not present in the original source but is generated dynamically by the language model based on the attacker's crafted context.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script, as it involves the execution of user-controllable input as active script commands. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically under sub-techniques involving Python code execution. The indirect nature of the injection further correlates with techniques observed in prompt injection attacks where adversaries manipulate AI systems into performing unintended actions by embedding instructions within trusted data sources.
Mitigation strategies must focus on breaking the chain of trust between untrusted web content and executable evaluation. Immediate remediation involves updating to a patched version of LaVague that implements strict output validation for any code generated from external sources. Developers should avoid using eval() or similar dynamic execution functions on strings derived from language model outputs unless those strings have been rigorously sanitized against known malicious patterns. Implementing allow-lists for permitted Python modules and restricting the runtime environment to a sandboxed container can further limit the blast radius of such an exploit. Additionally, organizations deploying LaVague should monitor their network traffic and system logs for unusual outbound connections or process executions that originate from the application's context, ensuring rapid detection of any potential exploitation attempts.