{"data":{"id":"469c0f89-5661-4c77-bbb0-deb593489286","title":"CVE-2026-85694: LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that…","summary":"LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object, which evaluates untrusted language model output derived from web page content. Attackers can use indirect prompt injection through web pages to inject malicious Python code that runs on the operator's host without review.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85694","publishedAt":"2026-09-04T15:17:47.540Z","cveId":"CVE-2026-85694","cweIds":["CWE-94"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LaVague 0.2.35"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LaVague remote code execution via web page prompt injection","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00942,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-gvgx-3mw6-m592"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T18:08:43.440Z","patchAvailable":null,"disclosureDate":"2026-09-04T15:17:47.540Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}