CVE-2026-42076
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
Evolver is an AI self-evolving engine that prior to version 1.69.3 had a command injection vulnerability in the _extractLLM() function. This allows attackers to execute arbitrary shell commands on the server due to improper handling of parameters.
Risk Assessment
This vulnerability poses a serious risk to server security, enabling remote code execution by attackers. It could lead to system takeover or data leakage.
Recommendation
It is recommended to upgrade to version 1.69.3 or later to mitigate this vulnerability. Additionally, implementing proper input sanitization mechanisms is advisable.
Other vulnerabilities in Evolver
See all- CVE-2026-42077Medium
In Evolver prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The _applyUpdate() and _updateRecord() functions use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype.
- CVE-2026-42075High
Evolver is an AI engine that prior to version 1.69.3 had a path traversal vulnerability in the skill download command. Attackers could write files to arbitrary locations on the filesystem, posing a risk of overwriting critical system files.
Original NVD description (English source)
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS