Vendor
LangAlpha versions through 2026.09.07 are vulnerable to indirect prompt injection that permits remote attackers to execute arbitrary code and exfiltrate credentials via insecure agent functions.