CVE-2026-85694 Overview
CVE-2026-85694 is a remote code execution vulnerability in LaVague 0.2.35, an AI-powered web agent framework. The flaw exists in PythonFromMarkdownExtractor.extract_as_object, which evaluates untrusted language model output derived directly from web page content. Attackers can plant malicious Python payloads on web pages the agent visits and leverage indirect prompt injection to force the LLM to emit code that the extractor then passes to eval(). The resulting code executes on the operator's host without any human review, giving the attacker full control over the process running the agent. The weakness is classified as CWE-94: Improper Control of Generation of Code.
Critical Impact
Any web page rendered by a LaVague agent can achieve arbitrary code execution on the operator host through indirect prompt injection into evaluated Python output.
Affected Products
- LaVague 0.2.35 (lavague-core)
- The PythonFromMarkdownExtractor.extract_as_object code path in lavague/core/extractors.py
- Any downstream agent or automation built on the vulnerable LaVague release
Discovery Timeline
- 2026-09-04 - CVE-2026-85694 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85694
Vulnerability Analysis
LaVague is a browser automation framework that uses large language models to translate natural language instructions into Python code executed against a live page. The PythonFromMarkdownExtractor component parses Markdown-fenced Python blocks returned by the model and hands them to Python's eval() for execution. Because the input passed to the model is derived from the DOM of pages the agent visits, an attacker who controls page content can influence the model's output.
The extractor performs no sandboxing, allow-listing, or static analysis of the generated code before execution. Once the attacker-influenced payload reaches eval(), it runs with the full privileges of the LaVague process. This enables credential theft, lateral movement, and pivoting into any local or cloud resources the operator can reach.
Root Cause
The root cause is direct evaluation of untrusted, model-generated code through eval() in extract_as_object. LaVague trusts the LLM to emit safe Python, but the model's output is shaped by web content that is outside the trust boundary. This is a classic code-injection pattern extended into the LLM supply chain [CWE-94].
Attack Vector
Exploitation is network-based and requires no authentication. An attacker publishes a web page containing an indirect prompt-injection payload, for example instructions embedded in visible text, HTML comments, or hidden elements. When the LaVague operator instructs the agent to visit or analyze the page, the injected instructions are incorporated into the prompt. The LLM emits a Python code block chosen by the attacker, the extractor strips the Markdown fencing, and eval() runs the payload on the operator host. Refer to the VulnCheck LaVague RCE Advisory and LaVague issue #650 for a full technical description.
No verified public exploit code is available. See the vulnerable extractor source for the affected implementation.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-85694
Indicators of Compromise
- Unexpected child processes spawned by the Python interpreter running LaVague, especially shells, package managers, or network clients.
- Outbound network connections from the LaVague host to domains not associated with legitimate automation targets.
- New or modified files in the LaVague working directory, user profile, or credential stores immediately after agent runs.
- LaVague logs containing Python code blocks that reference os, subprocess, socket, open, or __import__ beyond the expected automation surface.
Detection Strategies
- Instrument the extractor path to log every code string passed to eval() and review for calls that reach outside the browser automation API.
- Alert on process-tree anomalies where the LaVague Python process forks unrelated binaries such as curl, wget, bash, powershell, or python -c.
- Compare model outputs against a static allow-list of expected LaVague action primitives and flag deviations.
Monitoring Recommendations
- Forward LaVague application logs, host process telemetry, and outbound network flows to a central analytics pipeline for correlation.
- Baseline normal agent behavior per workflow and alert on new domains contacted, new file writes, or new modules imported at runtime.
- Track visits to untrusted or newly registered domains that precede anomalous process or network activity on the operator host.
How to Mitigate CVE-2026-85694
Immediate Actions Required
- Stop running LaVague 0.2.35 against untrusted or arbitrary web content until a fixed release is deployed.
- Restrict LaVague to a hardened, isolated environment such as a dedicated container or virtual machine with no production credentials mounted.
- Rotate any API keys, session tokens, or cloud credentials that were accessible to a LaVague host which visited untrusted pages.
- Review historical LaVague logs for evaluated code blocks that reference sensitive modules or network egress.
Patch Information
No fixed version is listed in the NVD record at the time of publication. Monitor the LaVague GitHub repository and issue #650 for a patched release, and consult the VulnCheck advisory for remediation updates. Until a patched release is available, replace eval()-based extraction with a strict parser that only accepts a fixed vocabulary of LaVague action primitives.
Workarounds
- Replace PythonFromMarkdownExtractor.extract_as_object with an abstract-syntax-tree parser that rejects any node outside an allow-list of safe operations.
- Execute agent-generated code inside a sandbox such as a restricted subprocess, seccomp profile, or ephemeral container with no network or credential access.
- Constrain the browsing surface to a curated allow-list of trusted domains to reduce exposure to indirect prompt injection.
- Add a human-in-the-loop review step before any model-generated Python is executed on the operator host.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
