Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
Priority HIGH 68CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00642 51st percentileScored 2026-11-07
Fix Fixed evolver (EvoMap): 1.69.3@evomap/evolver (npm): 1.69.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EvoMap | evolver | before 1.69.3 | 1.69.3 | Patch available | CNA |
| — | @evomap/evolver (npm) | before 1.69.3 | 1.69.3 | Patch available | GHSA-r466-rxw4-3j9j |
- evolver VendorEvoMap Affected before 1.69.3 Fixed in 1.69.3 Patch available CNA
- @evomap/evolver (npm) Vendor— Affected before 1.69.3 Fixed in 1.69.3 Patch available GHSA-r466-rxw4-3j9j
Remediation
- Fix · CNA evolver (EvoMap) Fixed in 1.69.3
- Fix · GHSA-r466-rxw4-3j9j @evomap/evolver (npm) Fixed in 1.69.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42075
- 2026-10-03 Alias added: GHSA-r466-rxw4-3j9j
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-27 EPSS moved to the 50th–90th percentile
References
More EvoMap vulnerabilities
- TI-2026-30444 Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution CVSS 3.1CRITICAL 9.8
- TI-2026-30445 Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations CVSS 3.1MEDIUM 5.2
Sources
- CVE-2026-42075 · CVE Program
- CVE-2026-42075 · NVD
- FIRST EPSS
- GHSA-r466-rxw4-3j9j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences