CVE-2026-85694

LaVague 0.2.35 contains a remote code execution flaw (CWE-94, improper code evaluation) in PythonFromMarkdownExtractor.extract_as_object, which evaluates language model output as Python code without any review. An attacker triggers it through indirect prompt injection: a web page processed by the LaVague agent embeds instructions that cause the LLM to emit attacker-crafted Python, which the extractor then executes on the operator's host. Successful exploitation yields arbitrary code execution, with high assessed impact on the confidentiality, integrity, and availability of the vulnerable system, reflected in the critical 9.2 CVSS 4.0 score. Affected are operators running LaVague 0.2.35 who use the framework to browse or extract content from untrusted web pages, since no user interaction or credentials are required. No public proof of concept is known, the issue is not in CISA KEV, and EPSS currently rates the 30-day exploitation probability at about 0.5 percent.

What to do: Upgrade to a patched LaVague release when one is published (no fixed version is specified in the advisory), and in the meantime avoid passing content derived from untrusted web pages through PythonFromMarkdownExtractor.extract_as_object, or run it in a sandboxed, least-privilege environment. Restrict agent browsing to trusted sites, review whether untrusted web content feeds the extractor, and monitor hosts running LaVague for unexpected process executions.