Remote Code Execution in LaVague via Indirect Prompt Injection

LaVague version 0.2.35 is vulnerable to remote code execution within its PythonFromMarkdownExtractor.extract_as_object function. This flaw exists due to the insecure evaluation of Python code that is extracted from language model (LLM) outputs. These outputs are derived from arbitrary web page content during automated browser interaction tasks. An attacker can craft a malicious web page containing instructions that trigger an indirect prompt injection attack. When a LaVague operator navigates to or processes this content, the LLM generates malicious Python code based on the injection, which is subsequently executed by the library on the operator's host system without validation or sandbox restrictions. This vulnerability poses a significant risk to users performing web automation or data extraction tasks.

Impact

Successful exploitation allows for arbitrary code execution on the host system running the LaVague automation agent. This can lead to full system compromise, data theft, or further lateral movement within the network, depending on the privileges of the service account or user running the LaVague framework.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Identify all instances of LaVague (0.2.35) in the environment by scanning for package manifestations or process execution patterns.
• Review internal automation pipelines and restrict the ability of the LaVague framework to process content from untrusted, public-facing web sources.
• Monitor logs for unauthorized Python execution or subprocess calls originating from the directory or service account where LaVague is deployed.