Executive brief
LaVague is an AI web automation framework that uses language models to control web browsers. Version 0.2.35 contains a critical flaw in how it processes model-generated output: it evaluates untrusted Python code extracted from web page content without validation. An attacker can inject malicious instructions into web pages that, when visited by a LaVague agent, will cause the framework to execute arbitrary code on the operator's computer.
Technical details
The vulnerability exists in the PythonFromMarkdownExtractor.extract_as_object method, which uses Python's eval() or similar unsafe code evaluation on language model output. An attacker can inject malicious Python code through web page content (indirect prompt injection), which the language model will include in its response. LaVague then unsafely evaluates this code, allowing arbitrary command execution. The attack requires network access to a web page that the LaVague agent will visit, but no authentication or user interaction beyond normal agent operation. This is a classic code injection flaw stemming from failure to validate or sandbox untrusted model outputs.
Affected products
- LaVague LaVague 0.2.35
Timeline
- 2026-09-04: disclosed