CVE-2026-85694

EUVD-2026-71143
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/lavague-ai/LaVague
https://github.com/lavague-ai/LaVague/blob/9024bb83/lavague-core/lavague/core/extractors.py
https://github.com/lavague-ai/LaVague/issues/650
https://www.vulncheck.com/advisories/lavague-0.2.35-remote-code-execution-via-eval-extraction