High severity8.1NVD Advisory· Published Sep 4, 2026

CVE-2026-85694

Description

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lavague/Lavaguellm-fuzzy
Range: <0.2.35

Patches

Vulnerability mechanics

References

github.com/lavague-ai/LaVague/blob/9024bb83/lavague-core/lavague/core/extractors.pynvd
github.com/lavague-ai/LaVague/issues/650nvd
www.vulncheck.com/advisories/lavague-0.2.35-remote-code-execution-via-eval-extractionnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000