Web pages can hijack LangAlpha agent and run shell commands

A vulnerability disclosed on 20 October 2026 says that LangAlpha, an agent framework from ginlix-ai, can be tricked into running arbitrary shell commands and Python code by anyone who can place text on a web page the agent reads.

The flaw is tracked as CVE-2026-109440 and is listed in the US National Vulnerability Database. According to the NVD entry, LangAlpha through version 2026.09.07 "contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent".

Indirect prompt injection is the technique of hiding instructions in material an AI agent fetches, such as a web page or document, so the model treats the attacker's text as if it came from the user. In this case the planted text does not just change the agent's answer. It reaches tools that run code.

The NVD record names two of those tools: Bash and ExecuteCode. It says both "lack an allow-list and human-in-the-loop approval", meaning there is no list of permitted commands and no point at which a person is asked to confirm before execution. The combination lets an attacker run code inside what the entry calls the workspace sandbox.

The record also describes what an attacker could take. It says they can "exfiltrate vault secrets from _internal/.vault_secrets.json", a file path within the project that holds stored credentials. No further detail on the contents of that file is given in the advisory.

The NVD entry lists three references. One points to a specific line in the agent source file in the ginlix-ai LangAlpha repository on GitHub, at a pinned commit. The other two are entries in the vulnerability databases run by Lasso Security and VulnCheck. The VulnCheck advisory is titled as covering indirect prompt injection leading to remote code execution via Bash and ExecuteCode.

The sources do not state whether a fixed release is available, and no patched version number is given. The affected range is described only as "through 2026.09.07". The sources do not say whether the flaw has been exploited against real deployments, and they do not record any statement from ginlix-ai.

The pattern described here is familiar to anyone tracking agent security. An agent that browses the web is, by design, reading untrusted input. If the same agent also holds tools that can execute code and read local secrets, the browsing step becomes a path into those tools. The two mitigations the advisory says are missing, an allow-list and human approval, are the standard controls for breaking that path.

Users running LangAlpha at or below 2026.09.07 should check whether their deployment grants the agent access to Bash and ExecuteCode, and whether a secrets file sits in the workspace the agent can reach. The sources provide no vendor guidance beyond the CVE description itself.