Critical RCE Vulnerability in LaVague 0.2.35 Disclosed
Article Content
- •CVE-2026-85694 affects LaVague version 0.2.35, enabling remote code execution.
- •Attackers can exploit the vulnerability via indirect prompt injection through web pages.
- •No public proof-of-concept or exploitation evidence has been reported yet.
A remote code execution vulnerability, CVE-2026-85694, has been identified in LaVague version 0.2.35. The flaw exists in the PythonFromMarkdownExtractor.extract_as_object function, allowing unauthenticated attackers to inject malicious Python code via web pages using indirect prompt injection. This could lead to arbitrary code execution on the operator's host without prior review. Currently, no public proof-of-concept or evidence of exploitation has been reported. Users are advised to update to a version beyond 0.2.35 and to implement sanitization and input validation measures. The CVSS base score assigned to this vulnerability is 8.1, indicating a high severity level. The vulnerability was published on September 4, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track CVE-2026-85694 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…