Vulnerability Description
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/lavague-ai/LaVague
- https://github.com/lavague-ai/LaVague/blob/9024bb83/lavague-core/lavague/core/ex
- https://github.com/lavague-ai/LaVague/issues/650
- https://www.vulncheck.com/advisories/lavague-0.2.35-remote-code-execution-via-ev
- https://github.com/lavague-ai/LaVague/issues/650
FAQ
What is CVE-2026-85694?
CVE-2026-85694 is a vulnerability with a CVSS score of 8.1 (HIGH). LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers c...
How severe is CVE-2026-85694?
CVE-2026-85694 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85694?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.