CVE-2026-42076criticalCWE-78

CVE-2026-42076: critical vulnerability in EvoMap evolver

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Published · Updated

Follow this CVE+ Monitor evolver+ Monitor @evomap/evolver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.7%
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
EvoMap · evolver
Related CVEs — EvoMap evolver

In the same product, most dangerous first.

CVE-2026-42075HIGHEvolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File WriteEPSS 0.6%CVE-2026-42077MEDIUMEvolver: Prototype Pollution via `Object.assign()` in mailbox store operationsEPSS 0.2%