CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

Ginlix AI LangAlpha security vulnerability

Ginlix AI LangAlpha versions 2026.09.07 and earlier contain a security vulnerability stemming from indirect prompt injection. Due to the absence of allowlists and manual approvals for Bash and ExecuteCode, attackers can insert commands into web pages retrieved by the proxy, thereby executing shel...