EUVD-2026-104680
GHSA-fcmr-j7xj-36vp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlant instructions in attacker web content
-
DeliveryAgent retrieves poisoned content during task
-
ExploitPrompt injection overrides agent controls
-
ExecutionBash/ExecuteCode runs code in sandbox
-
ImpactExfiltrate secrets from _internal/.vault_secrets.json
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that (1) the LangAlpha agent be directed to retrieve attacker-controlled web content (the indirect injection vector - UI:P/passive user interaction), and (2) the agent's Bash and ExecuteCode tools be available without an allow-list or human-in-the-loop approval, which is the described default behavior through version 2026.09.07. The concrete payload reads the workspace secrets file _internal/.vault_secrets.json. The principal limiting factor is that a user must actually run the agent against content an attacker can influence; there is no fully autonomous, zero-interaction path, and the affected product is niche, further constraining real-world reach. No authenticated access to the agent host is needed (PR:N). |
| Impact | Signals are mixed and point to a real but non-emergency priority. The CVSS 4.0 base score is 8.7 (High) with AV:N/AC:L/PR:N, meaning a remote, unauthenticated trigger with low complexity, but UI:P confirms exploitation is passive-user-interaction dependent - a victim must have the agent retrieve attacker-controlled web content, which sharply limits opportunistic mass exploitation. EPSS is low at 0.43% (36th percentile), consistent with no confirmed in-the-wild activity: this CVE is NOT in CISA KEV, so there is no confirmed active exploitation. The input lists a PoC as a reference only, not verified as working exploit code, so this is 'a public PoC reference exists; it is not verified as working exploit code' rather than a weaponized exploit. The vuln.today Decision label is 'this_week', which sets the urgency ceiling: this should be remediated within the week, not treated as act_now/emergency, and the low EPSS plus absence from KEV support that cadence. Net: a genuine high-impact flaw (full code execution and secret exfiltration) gated behind user-driven agent interaction and deployed in a niche product, so prioritize patching but it is not a drop-everything scenario. No key signals conflict with the CVSS vector; the main real-world dampeners are the UI:P requirement and the limited deployment footprint. |
| Exploit ScenarioDerived | An attacker plants hidden instructions in web content (e.g., a page or document the agent will fetch). When a LangAlpha user tasks the agent with research or browsing that reaches the poisoned content, the injected instructions hijack the agent into invoking its Bash or ExecuteCode tools - which lack an allow-list and human approval - to run arbitrary shell/Python in the workspace sandbox and read _internal/.vault_secrets.json. A public PoC reference exists (Lasso Security vulnerability-database entry) but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 22, 2026
Indirect prompt injection in LangAlpha through 2026.09.07 allows remote attackers to run shell commands or Python inside the agent's workspace sandbox by planting instructions in web content the agent retrieves; the described payload then reads vault secrets from _internal/.vault_secrets.json. No CISA KEV entry or confirmed active exploitation is reported, and a public PoC reference exists; it is not verified as working exploit code. EPSS is 0.43% (36th percentile), the reporting source is VulnCheck, and the vuln.today priority is this_week, reflecting a real but non-emergency risk.
Earlier versions of this analysis (1)
Indirect prompt injection in LangAlpha (ginlix-ai) through 2026.09.07 lets remote attackers turn poisoned web content into shell or Python execution inside the agent's workspace sandbox. Because the Bash and ExecuteCode tools ship with no allow-list and no human-in-the-loop approval, an agent that merely fetches attacker-controlled pages can be steered into running arbitrary commands and then reading vault secrets from _internal/.vault_secrets.json. Exploitation is unauthenticated from the attacker's side but depends on the agent retrieving the malicious content, and publicly available exploit code exists; no CISA KEV entry confirms active in-the-wild use at time of analysis.
RemediationAI
The supplied advisory data does not list a vendor-released patch or fixed version for LangAlpha through 2026.09.07; check the VulnCheck advisory (https://www.vulncheck.com/advisories/langalpha-through-2026.09.07-indirect-prompt-injection-rce-via-bash-and-executecode) and the Lasso entry (https://www.lasso.security/vulnerability-database/cve-2026-109440) for an update. Until a fix is available, disable the Bash and ExecuteCode tools or place them behind a strict allow-list and mandatory human-in-the-loop approval for agents that ingest web content; this reduces functionality and adds operator friction. Move _internal/.vault_secrets.json out of the workspace and give the sandbox only scoped, read-only credentials so the file is not reachable; this may require re-architecting secret delivery. Restrict sandbox egress to block exfiltration of secrets, accepting that legitimate outbound integrations may need explicit exceptions. Where possible, run the agent only against trusted content and isolate each workspace.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LangAlpha is a Python AI agent framework (CPE ginlix-ai:langalpha) whose agent can retrieve web pages and then call tools. The flaw is CWE-1427: instructions embedded in retrieved web content are not neutralized before being treated as model instructions, so the agent can be steered into invoking its Bash and ExecuteCode tools. Those tools lack an allow-list and human-in-the-loop approval in the described default behavior through 2026.09.07, so the injected instruction can execute shell or Python in the workspace sandbox. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: no host authentication is needed, but the user must direct the agent at attacker-influenced content (passive user interaction). The concrete payload targets _internal/.vault_secrets.json, allowing exfiltration of vault secrets; CVSS 4.0 subsequent-system metrics are N, so the described impact is confined to the sandbox/workspace and its secrets rather than full host compromise.
Know when Langalpha gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, no privileges, but a user must have the agent fetch attacker content (UI:R); impact stays within the sandbox workspace (S:U) with full code execution yielding C/I/A High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
Technical POC Analysis
CWE-1427 (improper neutralization of input used for LLM prompting) escalating to arbitrary code execution.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
LangAlpha, an AI agent product, contains an indirect prompt injection vulnerability that could allow attackers to execute arbitrary commands within the agent's sandbox and potentially access sensitive secrets stored in the vault. While no active exploitation has been confirmed and a working exploit is not verified, the high severity and the product's role in automated workflows mean that a successful attack could disrupt operations and expose confidential data. Security leadership should prioritize remediation given the potential for lateral movement and data breach.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting the agent's ability to fetch external web content, implementing strict network segmentation and egress filtering, enforcing least privilege on the agent's workspace and vault access, and monitoring for unusual command execution or secret access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB