VULNERABILITY INTELLIGENCE
CVE-2026-85694
CVSS score8.1 HIGH
EPSS probability0.94%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
Weakness classification
- disclosure@vulncheck.com: CWE-94