CRITICAL 9.2 NVD
CVE-2026-85694
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output de
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
References
- https://github.com/lavague-ai/LaVague
- https://github.com/lavague-ai/LaVague/blob/9024bb83/lavague-core/lavague/core/extractors.p
- https://github.com/lavague-ai/LaVague/issues/650
- https://www.vulncheck.com/advisories/lavague-0.2.35-remote-code-execution-via-eval-extract
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-09-04 via NVD.
Risk Timeline
CVE Disclosed2026-09-04 · -1 days ago
Remediation Resources
vulnfeed aggregates 8217 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.