Latest
●Mem0 memory keys can be forged to read other tenants' chats●vLLM's wildcard CORS default let any website query local servers●Rust zip crate flaw lets archives hide a second filename●Microsoft says agents in Microsoft 365 grew 15-fold in a year●Attacker Poses as AI Crawlers to Hunt for Exposed Credentials●Functype MCP server flaw let tool calls run arbitrary code●Token Security says blast radius matters more than patch speed●OpenAI agent validated 14 leaked Hugging Face tokens
Wednesday, 28 October 2026
6 agent hacks today▼ 4 vs yesterday (10)
The Agentic TimesPowered byVortal

Incident database

LaVague 0.2.35 Remote Code Execution via Prompt Injection

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code.

Disclosed 4 September 2026 · Record updated 1 October 2026

Impact

Arbitrary code execution on the operator's host through indirect prompt injection via web page content

Our coverage

No articles linked to this incident yet.

Sources

  1. github.comhttps://github.com/advisories/GHSA-gvgx-3mw6-m592