Remote Code Execution in LaVague via Malicious Markdown

Executive Summary

This vulnerability in LaVague 0.2.35 allows remote code execution due to improper handling of untrusted language model output. The PythonFromMarkdownExtractor.extract_as_object function evaluates Python code derived from web page content without sanitization. Attackers can inject malicious Python code via indirect prompt injection, executing arbitrary commands on the operator's system without review.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if LaVague 0.2.35 or earlier is installed by running commands like 'pip show lavague' or 'pip list | grep lavague'. Inspect the extractors.py file in the LaVague core package for the PythonFromMarkdownExtractor.extract_as_object function, which uses eval() on untrusted input. Look for suspicious web pages triggering code execution or unexpected system behavior during LaVague agent operations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious code on your machine, potentially stealing data, installing malware, or taking control of your system. Since LaVague processes web content automatically, visiting a single malicious page could trigger the attack without any user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution on systems handling sensitive data, potentially violating GDPR's integrity and confidentiality requirements (Article 32) and HIPAA's security rule (45 CFR Part 164) by allowing access to protected health information. The remote code execution risk may result in data breaches, unauthorized data exfiltration, or system manipulation, all of which are critical compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade LaVague to a patched version if available. Avoid using eval() on model output; replace it with safe alternatives like ast.literal_eval or json.loads. Disable LaVague's telemetry if enabled by setting LAVAGUE_TELEMETRY=NONE. Restrict LaVague agents from accessing untrusted web pages and implement sandboxing for any code execution paths.

Useful 0 Not Useful 0