The vulnerability in LangAlpha prior to 2026.09.07 is an indirect prompt injection flaw that permits an attacker to cause the agent to execute arbitrary shell or Python code. Because the Bash and ExecuteCode functions lack an allow‑list and do not require human approval, embedded instructions in fetched web content are executed in the workspace sandbox. An attacker who can inject such content can run any command and exfiltrate sensitive vault secrets from the internal .vault_secrets.json file. This flaw represents a remote code execution issue capable of compromising confidentiality, integrity, and availability of the affected system.

LangAlpha, distributed by ginlix‑ai, version 2026.09.07 and earlier contains this issue. The affected component is the agent module that reads external web content and forwards it to the Bash and ExecuteCode execution back‑ends.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is 0.00432 (0.43%), indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the lack of an allow‑list and the lack of any user confirmation make exploitation straightforward for anyone able to supply crafted web content. The attack vector is inferred to be remote, originating from the agent's ability to download and execute web content. Once a payload is embedded, the agent will run it in the sandbox, allowing exfiltration of secrets and full system compromise.