CVE-2026-42076

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

Vulnerability Details

Published Date

May 04, 2026

Last Modified

May 07, 2026

CWE ID

CWE-78

Source

NVD

Vendor

EvoMap

Product

evolver

External References

https://github.com/EvoMap/evolver/releases/tag/v1.69.3
https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53

CVE-2026-42076

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment