LaVague web agent executes attacker-supplied Python extracted from LLM output, enabling RCE via indirect prompt injection

Undisclosed·LaVague (PythonFromMarkdownExtractor.extract_as_object)

LaVague 0.2.35's PythonFromMarkdownExtractor.extract_as_object takes markdown-formatted output the LLM generates from scraped web page content and evaluates the Python code embedded in it directly on the host, so a web page crafted with hidden instructions can get its injected Python code executed as if it were the agent's own generated automation code.

Blast radius

Per the NVD/OSV record, any attacker who can get a LaVague-driven agent to visit a crafted web page can achieve arbitrary code execution on the operator's host; no specific victim organization, incident, or number of affected deployments is disclosed in the record.

Root cause

The extractor treats LLM-generated 'Python to run' output as trusted and evaluates it directly, without recognizing that the LLM's output is itself influenced by untrusted, attacker-controlled web page content (indirect prompt injection flowing straight into code execution).

How it was caught

Not disclosed as a live-incident catch; the issue surfaced as a published vulnerability (CVE-2026-85694) in the NVD/OSV databases rather than through an observed exploitation report.

Take-awayNever eval/exec LLM output that was derived, even indirectly, from untrusted web content — sandbox or strictly validate any code an agent is about to run before execution.