LangAlpha: instructions planted in web content the agent retrieves can make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools have no allow-list or human approval; CVE published 20 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | The LangAlpha user whose per-workspace sandbox and vault secrets the agent works with, including in scheduled automations that run the agent with no user present (Lasso Security) | assertion | CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution | medium |
| Mandate: objective | Financial research: the agent searches, fetches and crawls web content and runs code in a per-workspace sandbox (Lasso Security) | assertion | CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution | medium |
| Actor | LangAlpha through 2026.09.07, an AI agent that retrieves web content and has Bash and ExecuteCode tools | fact | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck) | high |
| Inputs | Instructions planted by a remote attacker in web content retrieved by the agent (indirect prompt injection) | fact | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck) | high |
| Decision | The agent follows the planted instructions and calls Bash or ExecuteCode | fact | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck) | high |
| Envelope: constraints | Bash and ExecuteCode lack an allow-list and human-in-the-loop approval; code runs in a workspace sandbox from which _internal/.vault_secrets.json is reachable | fact | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck) | high |
| Action | VulnCheck's CVE record states that attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json. Lasso Security's reproduction ran only a harmless id command, in a local harness where the sandbox was mocked by a local subprocess and the live hosted service was never contacted; reading or sending out the vault secrets was not demonstrated in the sources | assertion | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck); CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution | medium |
| Outcome | State: pending (no fixed version is named). No exploitation reported in the sources; Lasso Security lists no known exploit and describes a proof of concept on a local harness. As of Oct 2026. | assertion | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck); CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution | medium |
| Evidence: event | CVE-2026-109440 (Common Vulnerabilities and Exposures identifier) published 20 October 2026 by VulnCheck as CVE Numbering Authority (CNA); the record gives 15 October 2026 as the date the flaw was made public, and VulnCheck's advisory is dated 19 October 2026. Recorded in the National Vulnerability Database (NVD) on 20 October 2026, status Deferred. Weakness CWE-1427 (Common Weakness Enumeration entry: improper neutralization of input used for large language model prompting). Severity (CVSS, the Common Vulnerability Scoring System) as scored by VulnCheck: CVSS 4.0 8.6 High (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) and CVSS 3.1 8.1 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N); Lasso Security's entry shows 9.6 Critical, with availability impact High where VulnCheck scores None, and names no scoring version. Finders credited: Noy Pearl, Michael Sromin, Ophir Dror. References: LangAlpha source at commit 435a5a4 (src/ptc_agent/agent/agent.py, line 524), the Lasso Security entry and the VulnCheck advisory | fact | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck); LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode; CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution | high |
| Recovery: technical | No fixed version is named in the CVE record, VulnCheck's advisory or Lasso Security's entry. Lasso Security recommends gating Bash and ExecuteCode behind human approval, at least on turns that include untrusted retrieved content or by default in the hosted service, not relying on a natural-language security prompt to protect the vault secrets file, keeping that file out of direct shell and code reach behind a mediated broker tool, and adding sandbox egress controls (limits on outbound network traffic) | assertion | CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution; NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck); LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode | medium |
| Recovery: accountability | not evidenced in source | assertion | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck) | low |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Mechanism: the record names instructions planted in web content retrieved by the agent as the route to shell and Python execution. Why it interrupts: if retrieved web content were treated only as data, the planted instruction would not become a Bash or ExecuteCode call. Source shows it failed: the agent executes the planted instructions. | C-I1 Retrieved content as data |
| absent | Mechanism: Bash and ExecuteCode run without human-in-the-loop approval, so the injected command executes and, per the CVE record, the vault secrets can be sent out. Why it interrupts: a confirmation step before code execution would put a human decision between the planted instruction and the command. Source shows it absent: the record states the tools lack human-in-the-loop approval. | C-E3 Destructive-action gate |
| absent | Mechanism: Bash and ExecuteCode have no allow-list of permitted commands. Why it interrupts: an enforced allow-list of permitted commands would refuse commands outside the task, such as reading the vault secrets file and sending it out. Source shows it absent: the record states the tools lack an allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown. | C-M2 Machine-enforceable scope |
Inference
inference The record describes a path, not an incident: VulnCheck's CVE (Common Vulnerabilities and Exposures) record says instructions planted in web content the agent retrieves can drive its Bash and ExecuteCode tools, which have no allow-list and no human approval, to run code in the workspace sandbox and exfiltrate (send out) vault secrets from _internal/.vault_secrets.json. Lasso Security showed the first step only, in a local harness with the sandbox mocked: an injected page made the model issue a harmless Bash call. Lasso recommends approval on these tools, a mediated broker for the secrets and limits on outbound traffic, without saying which alone would suffice. The sources do not show secrets being read or sent out, any exploitation, or a fix.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-109440 | NVD record CVE-2026-109440: LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (CNA title; CNA: VulnCheck) | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| LASSO-109440 | CVE-2026-109440: Indirect Prompt Injection to Ungated Sandbox Code Execution (interest: Security vendor that publishes the database entry) | researcher primary record | lasso.security ↗ checked 2026-10-21 |
| VULNCHECK-109440 | LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode | researcher primary record | vulncheck.com ↗ checked 2026-10-21 |