LaVague version 0.2.35 contains a critical remote code execution vulnerability in the PythonFromMarkdownExtractor.extract_as_object method. The vulnerability arises from the unsafe evaluation of untrusted language model output that is derived from web page content. Attackers can exploit this flaw through indirect prompt injection by embedding malicious Python code within web pages visited by the LaVague agent. When the LLM processes the malicious web content, the injected code is passed to an eval() call without sanitization or human review. This allows attackers to execute arbitrary code on the operator's host system. The attack requires no direct access to the target system, making it particularly dangerous for automated AI agent workflows. The vulnerability is tracked as CVE-2026-85694 and affects the lavague-core component of the LaVague framework.
