CVE-2026-42076

CRITICAL

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Title source: cna
STIX 2.1

Description

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/EvoMap/evolver/releases/tag/v1.69.3

Scores

CVSS v3 9.8
EPSS 0.0131
EPSS Percentile 66.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
evomap/evolver 0 - 1.69.3npm
EvoMap/evolver < 1.69.3
Published May 04, 2026
Tracked Since May 04, 2026