GHSA-jxh8-jh77-xh6g
High · 8.1CVSS
8.1
EPSS
—
Published
May 5, 2026
CISA due date
—
The record
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @evomap/evolver | 0 | 1.70.0-beta.5 |
Related vulnerabilities
- GHSA-7xp7-m392-h92c @evomap/evolver has an unbounded request body in proxy /asset/submit that causes… Also affects @evomap/evolver
- GHSA-cfcj-hqpf-hccf @evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows… Also affects @evomap/evolver
- CVE-2026-42075 Evolver is a GEP-powered self-evolving engine for AI agents. Also affects @evomap/evolver
- CVE-2026-42076 Evolver is a GEP-powered self-evolving engine for AI agents. Also affects @evomap/evolver
- CVE-2026-42077 Evolver is a GEP-powered self-evolving engine for AI agents. Also affects @evomap/evolver
- GHSA-r466-rxw4-3j9j Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write Also affects @evomap/evolver
- GHSA-j5w5-568x-rq53 Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code… Also affects @evomap/evolver
- GHSA-2cjr-5v3h-v2w4 Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations Also affects @evomap/evolver