Tracking: CVE-2026-85694
Severity: High (CVSS 3.1: 8.1); Critical under CVSS 4.0 (9.2)
Who is affected
lavague-core through 0.2.35. An attacker must influence a webpage processed by the agent and cause its model output to reach the vulnerable extraction path.
How the attack works
PythonFromMarkdownExtractor.extract_as_object evaluates Python from model-produced Markdown. A malicious page can steer that output through indirect prompt injection, turning content the agent reads into code the operator's host executes.
The trust boundary fails between external page text, generated output, and local Python evaluation. Successful exploitation runs code with the agent process's permissions, potentially exposing accessible files, credentials, and internal services.
What to do
- Avoid processing untrusted pages through this extraction path until a vendor-confirmed fix is available. The reviewed record does not identify a patched release.
- Replace executable evaluation with a data-only parser where feasible. Treat model-generated text as untrusted input.
- Constrain the agent's filesystem, credentials, and network access. If suspicious pages were processed, review generated output and subsequent host activity.
Scope and limits
Exploitation depends on attacker-influenced output reaching Python evaluation. A page visit alone does not establish that the vulnerable path ran.