CVE-2026-109440

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109440

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-109440.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-109440

Published

2026-10-20T00:46:05Z

Modified

2026-10-20T10:46:11Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

Details

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-1427"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109440.json"
}

References

Affected packages

Git / github.com/ginlix-ai/langalpha

Affected ranges

Type

GIT

Repo

https://github.com/ginlix-ai/langalpha

Events

Introduced

Last Affected

435a5a44fabdeb33e409a62d233a936d96241c86

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2026.09.07"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

desktop-oss-v0.*

desktop-oss-v0.2.0

desktop-oss-v0.2.1

desktop-oss-v0.2.3

desktop-v0.*

desktop-v0.2.0

desktop-v0.2.1

desktop-v0.2.3

v2026.*

v2026.04.07

v2026.04.13

v2026.04.23

v2026.04.30

v2026.06.12

v2026.06.14

v2026.06.19

v2026.06.27

v2026.07.17

v2026.07.22

v2026.07.30

v2026.08.05

v2026.09.01

v2026.09.07

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-109440.json"