Description

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T15:17:47.540Z",
  "pubdate": "2026-09-04T15:17:47.540Z",
  "executiveSummary": "LaVague version 0.2.35 is susceptible to a critical Remote Code Execution (RCE) vulnerability stemming from insecure handling of untrusted input. The flaw resides within the PythonFromMarkdownExtractor.extract_as_object function, which processes and executes code dynamically generated by a Language Model (LM) based on external web content.\nThis vulnerability allows an attacker to perform indirect prompt injection by embedding malicious payloads within a web page. When the LaVague automation agent processes the targeted site, the LM interprets the injected instructions and generates corresponding malicious Python code.\nBecause the application evaluates this LM-generated code without sufficient validation or sandboxing, an attacker can achieve arbitrary code execution on the operator's host. The impact of a successful exploitation is severe, granting the attacker full control over the host environment under the identity of the running process. This exposure is particularly dangerous for users automating interactions with untrusted or compromised web resources, as it bypasses standard security controls by leveraging the inherent trust placed in the LM's output.",
  "technicalDetails": "The vulnerability is located in the PythonFromMarkdownExtractor.extract_as_object method of the LaVague framework, version 0.2.35. The root cause is the reliance on dynamic execution—specifically the invocation of Python's evaluation primitives (such as exec() or eval())—on output returned by a Large Language Model (LM) without prior sanitization or context isolation.\nThe attack vector originates from indirect prompt injection, where an attacker hosts a malicious payload on a web page reachable by the LaVague agent. The attack flow proceeds as follows: First, the LaVague agent navigates to the attacker-controlled webpage, which contains hidden instructions or adversarial text crafted to manipulate the LM's reasoning. Second, the LM consumes this content and, influenced by the injection, generates a sequence of Python code that includes the attacker's payload. Third, the framework passes this untrusted string to the PythonFromMarkdownExtractor.extract_as_object function. Finally, the function interprets and executes the malicious payload directly on the host machine.\nThis exploit bypasses conventional execution barriers because the code is synthesized dynamically during the runtime processing phase. By embedding malicious snippets, an attacker can execute arbitrary system commands, exfiltrate local files, establish persistent backdoors, or interact with sensitive services accessible from the operator's environment. The vulnerability does not require authentication from the attacker's perspective, as the entry point is the consumption of standard web content by the agent. Since the framework trusts the LM to provide safe, functional code for browser automation, the execution flow proceeds automatically without manual review or validation steps. The lack of an isolated execution environment, such as a secure container or gVisor sandbox, ensures that the attacker's payload executes with the same privileges as the LaVague process, leading to full system compromise."
}