CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from internal/.vaultsecrets.json.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to plant malicious instructions in web content that the LangAlpha agent retrieves. Exploitation also requires a user interaction, as reflected by the UI:R vector.
Are default safeguards sufficient to prevent this?
No. The affected Bash and ExecuteCode capabilities lack both an allow-list and human-in-the-loop approval, allowing retrieved prompt content to trigger code execution in the workspace sandbox.
What is the likely impact if exploitation succeeds?
An attacker can execute shell commands or Python code in the workspace sandbox and may exfiltrate vault secrets stored in _internal/.vault_secrets.json.
What can be done while patching is unavailable?
The provided information supports restricting or disabling Bash and ExecuteCode, adding an allow-list for permitted commands or code actions, and requiring human approval before those capabilities run. Avoid retrieving or processing untrusted web content with an agent that retains these capabilities.