LaVague Indirect Prompt Injection to Remote Code Execution via Unsafe Markdown-to-Python Evaluation

Technical Analysis

LaVague's PythonFromMarkdownExtractor.extract_as_object function parses markdown blocks from LLM completions and evaluates embedded Python code to drive browser automation actions. The entry point is any web page the agent visits during its task, since page content is fed into the LLM's context and can contain crafted text designed to manipulate the model's output. Because the extracted code is passed directly to an evaluation routine without sandboxing, allow-listing, or human review, an attacker's injected instructions become executable code on the host running the agent, granting full command execution equivalent to the agent process's privileges. This crosses the boundary between untrusted external content (web pages) and local system execution, bypassing any implicit trust boundary between the LLM's reasoning output and the host environment.

Affected Systems

LaVague

Detection Signatures

• Monitor agent logs for eval()/exec() calls immediately following LLM completions derived from browsed web content
• Alert on Python code blocks in markdown responses containing os.system, subprocess, socket, or file I/O calls not part of expected browser automation actions
• Flag LLM outputs where code content diverges significantly from the expected DOM-interaction action schema
• Inspect visited URLs for anomalous embedded text patterns resembling instruction-style content (e.g., hidden divs, alt text, comments) intended to steer LLM output
• Review outbound network connections or process spawns originating from the LaVague agent process during or after web page visits

Remediation Steps

1. 1

   Upgrade LaVague

   Apply the vendor patch or upgrade to a version beyond 0.2.35 once available that removes unsafe code evaluation.

2. 2

   Sandbox code execution

   Run any code extraction/execution logic in a restricted, network-isolated sandbox (e.g., containerized subprocess with no filesystem or network access) rather than the host process.

3. 3

   Restrict action schema

   Replace free-form Python code generation with a constrained, structured action DSL (e.g., JSON action objects) that cannot express arbitrary code execution.

4. 4

   Input sanitization

   Strip or neutralize suspicious instruction-like content from scraped web pages before including it in LLM context (content filtering, prompt-injection detection classifiers).

5. 5

   Human-in-the-loop approval

   Require explicit human confirmation before executing any generated code that performs actions beyond standard click/type/navigate browser operations.

6. 6

   Least privilege execution

   Run the agent process under a low-privilege account/container with no access to sensitive credentials, filesystem paths, or internal network segments.