CVE-2026-109440

LangAlpha web content can trigger unapproved sandbox commands

ginlix-ai · LangAlpha

First documented disclosure · Review checkpoint

Summary

Research demonstrated indirect prompt injection from retrieved web content into the agent’s execution tools.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Retrieved instructions share model context with always-available Bash and ExecuteCode tools.

Conditions required

The agent retrieves attacker-controlled content; sensitive tools remain ungated.

Potential impact

Commands could access data and secrets available inside the workspace sandbox.

Affected versions and configurations

Through 2026.09.07, per the CNA.

Fix and mitigation status

No fixed release identified in the reviewed sources.

Practical next steps

Require approval for sensitive execution, keep secrets behind mediated tools, and restrict sandbox egress.

Operating lesson

A natural-language instruction is not an access-control boundary.

Evidence and limits

The CNA records October 15 public disclosure. Lasso used a local harness with mocked Daytona and a benign command; production secret theft and sandbox escape were not demonstrated.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources