CVE-2026-109440

8.1High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality, integrity
Weakness: —

Impact

Attackers can execute arbitrary shell commands and Python code in the sandbox to steal vault secrets from _internal/.vault_secrets.json. They achieve this by planting indirect prompt injection instructions into web content that the agent ingests.

Root cause

The Bash and ExecuteCode agent tools lack an execution allow-list and require no human-in-the-loop approval before executing model-generated commands.

Affected systems

LangAlpha through 2026.09.07

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Fix & remediation

No fixed version is specified; disable the Bash and ExecuteCode tools or restrict the agent from fetching untrusted web content until a patch is released.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109440