critical · CVSS v3 8.1 · CVSS v4 8.6 · EPSS 0.00432

CVE-2026-109440

LangAlpha versions up to 2026.09.07 contain an indirect prompt injection flaw that lets attackers embed shell or Python commands in web cont

Overview

LangAlpha versions up to 2026.09.07 contain an indirect prompt injection flaw that lets attackers embed shell or Python commands in web content processed by the agent. The vulnerability bypasses the Bash and ExecuteCode modules, which lack allow-lists and human approval, enabling code execution within the workspace sandbox. Attackers can exfiltrate vault secrets stored in _internal/.vault_secrets.json.

Description

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

Impact

The flaw compromises confidentiality by allowing secret exfiltration, integrity by permitting arbitrary code execution, and availability if the sandbox is overwhelmed. Defenders using LangAlpha in shared or multi-tenant environments are directly impacted, especially those storing sensitive data in the internal vault.

Remediation

Apply the latest LangAlpha patch (≥2026.09.08) that implements allow-lists for Bash and ExecuteCode. Enable human‑in‑the‑loop approval for any agent‑initiated code execution. Restrict the agent to trusted content sources, monitor sandbox activity for anomalous commands, and rotate vault secrets regularly.

Risk context

The CVSS v3 score of 8.1 and v4 score of 8.6 classify this as critical, though the EPSS of 0.00432 indicates a low probability of exploitation. Defenders should treat this as a high‑priority issue but remain calm while applying mitigations.

Affected products

  • LangAlpha 2026.09.07

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
8.1
CVSS v4
8.6
EPSS
0.00432

prompt-injection shell-execution vault-secrets LangAlpha critical sandbox-exfiltration

← All CVEs

Related CVEs

critical

CVE-2026-113390

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-107400

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

View analysis

critical

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (for example, [email protected]). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the :authority value for Host and replace any existing Host field. Root cause * HTTP/2 to HTTP/1.1: Host was generated from :authority only when the request had no Host header, so a conflicting client Host was forwarded unchanged. * HTTP/2 to HTTP/2: the client Host header was removed and used to overwrite the upstream :authority, after request filters had already run against the original :authority. * The HTTP/2 server did not compare Host with :authority and did not reject userinfo in the authority. Impact A remote, unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Where request filters, access controls, or cache keys use the URI authority and the upstream routes by Host, this can lead to: * Cache poisoning: a response from another virtual host is stored under the victim host's cache key and served to other users (this also requires the upstream to serve different content per Host). * Host-based access control bypass: a request approved for one host is served by a different virtual host on the upstream. Deployments that do not accept HTTP/2 from clients, or that do not use the request authority for security or caching decisions, are not affected. Note that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients. Mitigation: * Upgrade to pingora 0.9.0 or later. Pingora now returns 400 Bad Request for HTTP/2 requests whose Host differs from :authority, that contain more than one Host, or whose authority contains userinfo, and keeps the upstream Host or :authority consistent with the request authority. Fix commits: https://github.com/cloudflare/pingora/commit/915590a91811877795531f6ba0927a3138b5cb4b , https://github.com/cloudflare/pingora/commit/ffab8302d08d4292d1924eb8fe84647fd5cb8e76 * If you cannot upgrade: in request_filter, reject HTTP/2 requests that carry a Host header different from the URI authority, or whose authority contains '@'.

View analysis

critical

CVE-2026-109395

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

View analysis