CVE-2026-109440Published
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109440 · Microsoft / collected KEV context
cve-program · CVE-2026-109440
- https://www.lasso.security/vulnerability-database/cve-2026-109440
- https://github.com/ginlix-ai/LangAlpha/blob/435a5a44fabdeb33e409a62d233a936d96241c86/src/ptc_agent/agent/agent.py#L524
- https://www.vulncheck.com/advisories/langalpha-through-2026.09.07-indirect-prompt-injection-rce-via-bash-and-executecode
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.