How do I check whether I am affected by CVE-2026-109440?

Self-hosted: check the deployed LangAlpha version (git tag / image), v2026.09.07 or earlier is affected. In src/ptc_agent/agent/agent.py, see whether Bash and ExecuteCode are in the tools list without being covered by the human-in-the-loop interrupt config (create_plan_mode_interrupt_config). Check whether any workspace has vault secrets or scheduled automations.

What is the fix for CVE-2026-109440?

No patched version named by Lasso, VulnCheck or the project releases as of 2026-10-23 (unknown; watch github.com/ginlix-ai/LangAlpha/releases for a server release after v2026.09.07). Interim: add Bash and ExecuteCode to the human-in-the-loop interrupt config, pause scheduled automations, block sandbox outbound network, keep high-value secrets out of the vault, rotate any secrets stored there if the agent browsed untrusted content.

Who is not affected by CVE-2026-109440?

Not affected if: managed-hosting.

Live › vulnerability › CVE-2026-109440

Go to dashboard

high8.8AI agents & MCP

LangAlpha: web-planted prompt injection runs shell commands and steals secrets

LangAlpha's agent always has Bash and ExecuteCode tools with no approval step, on the same agent that fetches web pages. A hidden instruction in a page, filing or news article can make it run shell or Python in the workspace sandbox and read _internal/.vault_secrets.json. Scheduled automations are exposed with no user present. No fixed release is published; v2026.09.07 is the last affected version and the newest server release.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs shell and Python code, steals vault secrets from workspace.
CVSS said: 8.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-109440

Go to dashboard

high8.8AI agents & MCP

LangAlpha: web-planted prompt injection runs shell commands and steals secrets

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs shell and Python code, steals vault secrets from workspace.
CVSS said: 8.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

LangAlpha: web-planted prompt injection runs shell commands and steals secrets

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

LangAlpha: web-planted prompt injection runs shell commands and steals secrets

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources