CVE-2026-85694

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2026-85694 LaVague 0.2.35 Remote Code Execution via eval extraction

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2026-85694 LaVague 0.2.35 Remote Code Execution via eval extraction

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2026-85694

LaVague 0.2.35 is vulnerable to remote code execution via its PythonFromMarkdownExtractor.extract_as_object function, which uses eval on untrusted language model output derived from web page content. An attacker can perform indirect prompt injection through a web page to inject malicious Python c...

CVE-2026-85694

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

EUVD-2026-71143

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

PT-2026-85580

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract as object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2026-85694: Improper Control of Generation of Code

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

flagembedding (1.3.2), lavague (1.0.10) +2 more potentially affected by CVE-2026-66007 via datasets (2.19.0)

datasets PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - flagembedding 1.3.2 - lavague 1.0.10 - radeval =0.0.1rc6, =0.0.1, =0.0.4 Source cves: CVE-2026-66007 Source advisory: OSV:PYSEC-2026-3716...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2024-8966 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2024-8966 Source advisory: OSV:PYSEC-2026-1410...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-49119 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-49119 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

itext2kg (>=0.0.1, <=0.0.3), lavague (>=1.0.9, <=1.0.23.post1) +3 more potentially affected by CVE-2026-55443 via langchain (0.1.10)

langchain PYPI version 0.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - itext2kg =0.0.1, =1.0.9, =0.0.15, =1.0.6, =1.0.0, =1.0.12 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-10783 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-48545 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-48545 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-28415 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-28415 Source advisory: OSV:GHSA-PFJF-5GXR-995X...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-28414 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-28414 Source advisory: OSV:PYSEC-2026-64...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2024-8966 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-JM2J...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2024-12217 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...