GHSA-j5w5-568x-rq53
Critical · 9.8CVSS
9.8
EPSS
—
Published
Apr 22, 2026
CISA due date
—
The record
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @evomap/evolver | 0 | 1.69.3 |
Related vulnerabilities
- CVE-2026-42076 Evolver is a GEP-powered self-evolving engine for AI agents. Same vulnerability
- GHSA-jxh8-jh77-xh6g @evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from… Also affects @evomap/evolver
- GHSA-7xp7-m392-h92c @evomap/evolver has an unbounded request body in proxy /asset/submit that causes… Also affects @evomap/evolver
- GHSA-cfcj-hqpf-hccf @evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows… Also affects @evomap/evolver
- CVE-2026-42075 Evolver is a GEP-powered self-evolving engine for AI agents. Also affects @evomap/evolver
- CVE-2026-42077 Evolver is a GEP-powered self-evolving engine for AI agents. Also affects @evomap/evolver
- GHSA-r466-rxw4-3j9j Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write Also affects @evomap/evolver
- GHSA-2cjr-5v3h-v2w4 Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations Also affects @evomap/evolver