Vulnerability · Published May 4, 2026 · Assigned by GitHub_M

CVE-2026-42076Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Critical 9.8

In plain English

A critical-severity OS command injection in evolver from EvoMap. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.7%top 22.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@evomap/evolver	1.69.3	GHSA-j5w5-568x-rq53

Affected products (as reported)

Vendor	Product	Versions
EvoMap	evolver	< 1.69.3

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53 x_refsource_CONFIRM
https://github.com/EvoMap/evolver/releases/tag/v1.69.3 x_refsource_MISC