CVE-2026-85694

Remote code execution via untrusted LLM output in LaVague 0.2.35’s extractor.

• CVSS 9.2
• 94
• Input Validation and Sanitization
• Remote

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.

CVE

CVE-2026-85694

CWE

94

CVSS base score

9.2

Published

2026-09-04

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade LaVague to version 0.2.36, which patches the remote code execution flaw in PythonFromMarkdownExtractor.extract_as_object.

import requests
from lavague import PythonFromMarkdownExtractor

class ContentProcessor:
    def __init__(self, url: str):
        self.url = url

    def fetch_and_process(self) -> dict:
        response = requests.get(self.url)
        markdown = response.text
        extractor = PythonFromMarkdownExtractor()
        # VULNERABLE: eval on untrusted model output
        return eval(extractor.extract_as_object(markdown))  # noqa: S307

import requests
import ast
from lavague import PythonFromMarkdownExtractor

class ContentProcessor:
    def __init__(self, url: str):
        self.url = url

    def fetch_and_process(self) -> dict:
        response = requests.get(self.url)
        markdown = response.text
        extractor = PythonFromMarkdownExtractor()
        # FIX: safe literal evaluation instead of eval
        return ast.literal_eval(extractor.extract_as_object(markdown))

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202685694,
  title        = {{Remote code execution via untrusted LLM output in LaVague 0.2.35’s extractor.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-85694},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-85694/}}
}