---
id: "CVE-2026-109440"
kind: "vulnerability"
aliases: ["CVE-2026-109440"]
title: "LangAlpha: web-planted prompt injection runs shell commands and steals secrets"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "LangAlpha", "fixed": [], "affected": "<= 2026.09.07", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "langalpha", "prompt-injection", "rce", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T01:17:10+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:35:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109440", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:35:18+00:00"}]
---

# LangAlpha: web-planted prompt injection runs shell commands and steals secrets

LangAlpha's agent always has Bash and ExecuteCode tools with no approval step, on the same agent that fetches web pages. A hidden instruction in a page, filing or news article can make it run shell or Python in the workspace sandbox and read _internal/.vault_secrets.json. Scheduled automations are exposed with no user present. No fixed release is published; v2026.09.07 is the last affected version and the newest server release.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:LangAlpha affected <= 2026.09.07 fixed ?

## How to check

Self-hosted: check the deployed LangAlpha version (git tag / image), v2026.09.07 or earlier is affected. In src/ptc_agent/agent/agent.py, see whether Bash and ExecuteCode are in the tools list without being covered by the human-in-the-loop interrupt config (create_plan_mode_interrupt_config). Check whether any workspace has vault secrets or scheduled automations.

## Fix

No patched version named by Lasso, VulnCheck or the project releases as of 2026-10-23 (unknown; watch github.com/ginlix-ai/LangAlpha/releases for a server release after v2026.09.07). Interim: add Bash and ExecuteCode to the human-in-the-loop interrupt config, pause scheduled automations, block sandbox outbound network, keep high-value secrets out of the vault, rotate any secrets stored there if the agent browsed untrusted content.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109440
- 2026-10-23T22:35:18+00:00 analyst — Lasso advisory + VulnCheck read: affected through v2026.09.07, no fixed release named; releases page shows no newer server release (only desktop 0.2.4/0.2.5). Bash/ExecuteCode are bound unconditionally in agent.py, no documented switch to disable. Not exploited; PoC only in Lasso local harness (id canary). Lasso rates 9.6 critical, NVD/VulnCheck 8.6-8.8. dbugs says 'prior to 2026.09.07 ... update to 2026.09.07' which contradicts the CVE record; ignore it. Related sibling CVE-2026-109441 (LangAlpha cross-tenant) exists. No social discussion searched.

## Documents

- [advisory] Lasso Security: CVE-2026-109440 LangAlpha indirect prompt injection to ungated sandbox code execution https://www.lasso.security/vulnerability-database/cve-2026-109440
- [advisory] VulnCheck advisory: LangAlpha through 2026.09.07 https://www.vulncheck.com/advisories/langalpha-through-2026.09.07-indirect-prompt-injection-rce-via-bash-and-executecode
- [describes] Lasso Security: five agent platforms ship an ungated shell tool https://theinjection.dev/items/lasso-agent-platform-shell-tool-cves/
- [mentions] LangAlpha releases (latest server release v2026.09.07) https://github.com/ginlix-ai/LangAlpha/releases

## From the sources

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_