CVE-2026-85694: a poisoned web page gets code execution on the operator's host through LaVague

NVD·high signalXBlueskyLinkedInCopy link

LaVague 0.2.35's PythonFromMarkdownExtractor.extract_as_object evaluates untrusted model output derived from page content, so an attacker who controls a page the browsing agent visits can inject Python that runs locally with no review step. CVSS v4.0 9.2, published 2026-09-04. This is the cleanest recent example of the whole indirect-injection chain completing, since the sink is a raw eval of whatever the model wrote after reading the attacker's text.