Skip to content
AI Security Wire

Published

- 4 min read

By

LangAlpha Prompt Injection Flaw Lets Web Pages Run Code in Agent Sandbox

prompt injection CVE-2026-109440 LangAlpha agentic AI sandbox CWE-1427
img of LangAlpha Prompt Injection Flaw Lets Web Pages Run Code in Agent Sandbox

An open-source AI agent for financial research can be steered by the web pages it reads. That is the claim behind CVE-2026-109440, published on October 20, 2026. The record says planted instructions in retrieved web content can make LangAlpha run shell commands or Python in its sandbox, and read secrets from a vault file.

In our assessment this is a textbook indirect prompt injection with a consequence attached. We cover it because, in our view, the missing control is a common one: in the files we read, nothing sits between the model’s decision and the tool.

What the record says

The NVD description reads: LangAlpha through 2026.09.07 “contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent.” It adds that Bash and ExecuteCode “lack an allow-list and human-in-the-loop approval,” so attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

The CVE was assigned by VulnCheck, which also supplies the score: CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P, high impact on confidentiality, integrity and availability) in NVD, where it is a secondary, CNA-provided score. VulnCheck’s own advisory page shows 8.6 for the same vector, and Lasso’s database page shows 8.8 with no vector. We did not compute the score. NVD had not published its own analysis and lists no CWE. VulnCheck’s advisory page gives CWE-1427, improper neutralization of input used for LLM prompting. Credit goes to Noy Pearl, Michael Sromin and Ophir Dror.

How the attack would work

We have not run an exploit, and none is described in the sources we read. The mechanism follows from the record and the code it references:

  1. The agent is asked to research something and fetches a page that an attacker controls or has edited.
  2. The page carries instructions aimed at the model, not the reader.
  3. The model treats them as part of the task and calls its shell or code-execution tool.
  4. Code runs in the workspace sandbox, where the vault file sits.

The NVD entry links to a line in src/ptc_agent/agent/agent.py at a September 7, 2026 commit. In that file the code-execution and Bash tools are added to the agent’s tool list directly, alongside file and search tools. The same file does wire a human-in-the-loop middleware, but its configuration (create_plan_mode_interrupt_config() in plan_mode.py at that commit) covers only the SubmitPlan tool, not Bash or code execution. On current main, agent.py still builds its tool list the same way; we did not check whether approval is applied elsewhere, so this is not a statement about a fix. That matches the CVE’s description, though it is our reading of two files.

The “UI:P” part of the vector reflects that someone has to ask the agent to do something that pulls in the poisoned content. It does not need the attacker to touch the victim’s machine.

What the sandbox does and does not buy you

Running tools inside a sandbox limits damage to the host. It does not protect anything the sandbox itself holds. Here the record says the secrets are inside the sandbox workspace. Lasso’s database entry adds that the sandbox has outbound network access and holds the user’s vault secrets, protected only by a natural-language prompt; we did not test that. A sandbox that holds credentials and can reach the network is a short walk from a breach.

What to do

These are our suggestions, not vendor guidance:

  • Check whether you run it. Find any LangAlpha deployment at or below 2026.09.07 and treat it as exposed.
  • Pin and review the latest commit yourself. The project publishes no release tags for the core app that we saw, and we could not confirm a fix.
  • Take secrets out of the sandbox. Use short-lived, narrowly scoped credentials injected per call, and never keep a vault file in the agent’s workspace.
  • Gate execution. Require human approval for Bash and code execution, or restrict them to an allow-list of commands.
  • Limit egress. Block outbound network access from the sandbox except to the sites the agent legitimately needs.
  • Restrict what the agent reads. For high-value deployments, limit browsing to an allow-list of domains.

What we do not know

Several things are open. We found no evidence of a fixed version as of October 27, 2026 in NVD, VulnCheck or Lasso. We have no vendor statement. We do not know whether the issue has been exploited; Lasso’s entry lists no known exploit, which is a single database field rather than an investigation. The three published scores (8.6, 8.7, 8.8) differ, so check the advisory yourself.

References

Frequently Asked Questions

What does CVE-2026-109440 allow?
Per the NVD record, instructions planted in web content that the LangAlpha agent retrieves can lead it to run shell commands or Python code in its workspace sandbox. The record says this can be used to exfiltrate vault secrets from a file named _internal/.vault_secrets.json. The vector shows no privileges required (our inference: no account on the target), but the agent has to fetch the poisoned content.
Which versions are affected and is there a fix?
The record covers LangAlpha through version 2026.09.07. We found no evidence of a fixed version as of October 27, 2026 in the NVD record, the VulnCheck advisory or Lasso's database entry. Our check of GitHub security advisories returned a gateway error, so that check is incomplete. The project keeps committing daily, but we did not verify whether any commit addresses this issue, so treat every current build as unconfirmed.
Is it being exploited?
We found no evidence of exploitation as of October 27, 2026 in the NVD record, the VulnCheck advisory page or CISA’s KEV feed (snapshot released October 26, 2026, 1758 entries, no match). The CVE is a week old, so that absence says little.