External risk intelligence

LaVague PythonFromMarkdownExtractor RCE via Untrusted Output

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-85694

LaVague is a framework for building AI agents and automation tools typically run by developers or data scientists in local environments or internal development pipelines. While it interacts with web content, it is not a standard internet-facing edge service or public gateway by design, making direct public-internet exposure uncommon in typical real-world deployments.

Code Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A remote code execution vulnerability exists in a Python component that processes web page content. This issue could allow attackers to inject malicious code through crafted web pages, potentially leading to the execution of arbitrary commands on the operator's host. The main concern is confirming the relevance and exposure of this specific technology within our environment.

Code execution risk from web content processing.
Affects systems processing web page content.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker can initiate a remote code execution attack by crafting a malicious web page. This page, when processed by the vulnerable component, can lead to arbitrary code execution on the host system.

Requires unauthenticated network access.
Evaluates untrusted web content.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to execute arbitrary code on a host running LaVague when it processes web content. This happens when untrusted language model output, derived from web pages, is evaluated without proper review, enabling indirect prompt injection.

Arbitrary code execution on operator's host.
Malicious Python code via web pages.
Compromise of host system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The described remote code execution vulnerability in LaVague's PythonFromMarkdownExtractor impacts operators who process untrusted language model output. The first step is to identify all instances of LaVague, determine their exposure and criticality, locate the accountable owner, and then plan remediation or risk mitigation based on that assessment.

Confirm LaVague deployment and assess exposure.
Accountable teams should verify business criticality.
Plan remediation or develop temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LaVague and why is it used?

LaVague is an open-source framework designed to help developers and data scientists build AI agents. It specializes in automating web interactions by translating natural language into code, allowing these agents to navigate and extract data from websites automatically as part of development or data processing pipelines.

What is the vulnerability in CVE-2026-85694?

This CVE involves a vulnerability classified as CWE-94, or Improper Control of Generation of Code. In simpler terms, a component in the software automatically runs code snippets derived from web content without verifying them first. If an AI agent processes a malicious page, it might unintentionally execute harmful commands embedded in that page as if they were safe instructions.

How can an attacker trigger this RCE vulnerability?

The attack path relies on an agent visiting a compromised or attacker-controlled website. The trigger occurs when the extractor processes the page and interprets injected prompts as executable Python code. Importantly, this issue does not stem from flaws in local Python scripts themselves, but specifically from the trust placed in external language model outputs generated from web data.

Is my environment at risk from this LaVague issue?

According to Halo Surface Signal, this software is typically used in local environments or internal pipelines rather than as a public-facing service, making widespread internet exposure unlikely. You should care primarily if your automated agents are configured to actively crawl or process content from arbitrary, untrusted websites as part of their routine operations.

What is the first step to address this threat?

Begin by auditing your internal repositories and infrastructure to identify any active deployments of LaVague version 0.2.35. Once located, consult with the teams managing these agents to determine if they process external, untrusted web content. After assessing the business criticality of those specific workflows, coordinate with the accountable owners to plan necessary remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.