CVE-2026-42076

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/EvoMap/evolver/releases/tag/v1.69.3
https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53
https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versión 1.69.3, una vulnerabilidad de inyección de comandos en la función _extractLLM() permite a los atacantes ejecutar comandos de shell arbitrarios en el servidor. La función construye un comando curl utilizando concatenación de cadenas y lo pasa a execSync() sin la sanitización adecuada, lo que permite la ejecución remota de código cuando el parámetro corpus contiene metacaracteres de shell. Este problema ha sido parcheado en la versión 1.69.3.

Information

Published : 2026-05-04 17:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-42076

Mitre link : CVE-2026-42076

CVE.ORG link : CVE-2026-42076

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-42076", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42076", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-05T13:06:18.539490Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"status": "affected", "version": "< 1.69.3"}]}]}], "published": "2026-05-04T17:16:24.440", "references": [{"url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "source": "security-advisories@github.com"}, {"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3."}, {"lang": "es", "value": "Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versi\u00f3n 1.69.3, una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n _extractLLM() permite a los atacantes ejecutar comandos de shell arbitrarios en el servidor. La funci\u00f3n construye un comando curl utilizando concatenaci\u00f3n de cadenas y lo pasa a execSync() sin la sanitizaci\u00f3n adecuada, lo que permite la ejecuci\u00f3n remota de c\u00f3digo cuando el par\u00e1metro corpus contiene metacaracteres de shell. Este problema ha sido parcheado en la versi\u00f3n 1.69.3."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "security-advisories@github.com"}