CVE-2026-109440
CVE-2026-109440 · LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
CVSS 8.7 · Élevée · EPSS 0,6%
- Publication
- Mise à jour
Produits et versions concernés
langalpha
- Versions du logiciel
- ≥ 0, ≤ 2026.09.07: Concernée (custom)
Aucun correctif publié
Sources originales
- https://www.lasso.security/vulnerability-database/cve-2026-109440
- https://github.com/ginlix-ai/LangAlpha/blob/435a5a44fabdeb33e409a62d233a936d96241c86/src/ptc_agent/agent/agent.py#L524
- https://www.vulncheck.com/advisories/langalpha-through-2026.09.07-indirect-prompt-injection-rce-via-bash-and-executecode
- https://nvd.nist.gov/vuln/detail/CVE-2026-109440