CVE-2026-85694 — LaVague 0.2.35 Remote Code Execution via eval extraction
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web pa…
Published: 2026-09-04 · CVSS: 9.2 · CVSS 4.0
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7