A critical remote code execution vulnerability in LaVague versions 0 through 0.2.35 allows unauthenticated attackers to execute arbitrary code on the host system via indirect prompt injection.

The vulnerability exists within the PythonFromMarkdownExtractor.extract_as_object method, which utilizes the unsafe Python eval function to process content returned by language models. An unauthenticated attacker can supply a malicious web page that triggers indirect prompt injection, forcing the model to generate and execute arbitrary Python code on the operator host.

Successful exploitation of this vulnerability grants an attacker full control over the host running the LaVague instance. This leads to complete system compromise, potential data exfiltration, and the ability to pivot into internal networks. Given the CVSS score of 8.1, this is a high-severity risk that could result in significant operational disruption and loss of sensitive information.

Immediate Action: There is currently no official patch available for this vulnerability; users should immediately restrict the use of LaVague on internet-facing systems or isolate the environment where it is deployed.

Proactive Monitoring: Monitor system process logs for suspicious Python execution patterns or unexpected outbound network connections originating from the LaVague service account.

Compensating Controls: Implement strict network egress filtering to prevent the LaVague host from communicating with malicious external domains and utilize sandboxing technologies to contain the execution environment.

Public Exploit Available: No (exploit_available: unknown)

Due to the severity of this remote code execution flaw and the lack of a vendor-provided patch, organizations must prioritize the isolation of affected LaVague instances. Administrators should disable the software until a security update is released or implement robust containerization to minimize the impact of a potential compromise.