CVE-2026-42076CWE-78

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Critical · published May 4, 2026

CVSS v3.1
9.8
EPSS
3%
Percentile
85.0
In the wild
Unconfirmed
What it is

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02563 · 85.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-04T16:48Z
EPSS history
Timeline
  • 04 MAY 16:48Z
    Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
    cvelistv5