Read the docs
TI-2026-30444 Aliases CVE-2026-42076GHSA-j5w5-568x-rq53

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Priority HIGH 82CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01705 77th percentileScored 2026-11-07
Fix Fixed evolver (EvoMap): 1.69.3@evomap/evolver (npm): 1.69.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EvoMapevolverbefore 1.69.31.69.3Patch availableCNA
—@evomap/evolver (npm)before 1.69.31.69.3Patch availableGHSA-j5w5-568x-rq53
  • evolver VendorEvoMap Affected before 1.69.3 Fixed in 1.69.3 Patch available CNA
  • @evomap/evolver (npm) Vendor— Affected before 1.69.3 Fixed in 1.69.3 Patch available GHSA-j5w5-568x-rq53

Remediation

  • Fix · CNA evolver (EvoMap) Fixed in 1.69.3
  • Fix · GHSA-j5w5-568x-rq53 @evomap/evolver (npm) Fixed in 1.69.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42076
  2. 2026-10-03 Alias added: GHSA-j5w5-568x-rq53

References

Advisory 1

Other 3

  • TI-2026-30443 Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write CVSS 3.1HIGH 8.1
  • TI-2026-30445 Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations CVSS 3.1MEDIUM 5.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences