CVE-2026-42076

9.8 Critique

Publiée le 04/05/2026 à 19:16 · Modifiée le 17/06/2026 à 12:47 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

Traduire en français

Produits concernés

EvoMap evolver

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/EvoMap/evolver/releases/tag/v1.69.3
https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53
https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories