{"data":{"id":"41003c1f-e030-4e16-893f-ed74d681808f","title":"CVE-2026-42075: Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in…","summary":"CVE-2026-42075 affects Evolver, a GEP-powered self-evolving engine for AI agents, prior to version 1.69.3. A path traversal flaw (CWE-22) in the skill download (fetch) command accepts unvalidated paths through the --out= flag, allowing attackers to write files to arbitrary filesystem locations. The source says this can overwrite critical system files or create files in sensitive locations.","solution":"This issue has been patched in version 1.69.3.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42075","publishedAt":"2026-05-04T17:16:24.283Z","cveId":"CVE-2026-42075","cweIds":["CWE-22"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@evomap/evolver@< 1.69.3 (fixed: 1.69.3)"],"affectedPackageNames":["@evomap/evolver"],"affectedPackageRefs":["npm:@evomap/evolver"],"affectedVendors":[],"affectedVendorsRaw":["Evolver"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Evolver path traversal in skill download fetch command via --out flag","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00642,"epssCheckedAt":"2026-11-09T12:10:45.242Z","kevDateAdded":null,"advisoryAliases":["GHSA-r466-rxw4-3j9j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:56.078Z","patchAvailable":true,"disclosureDate":"2026-05-04T17:16:24.283Z","fixReleasedAt":"2026-04-20T01:23:02.554Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:37:02.473Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@evomap/evolver","fixedVersion":"1.69.3","matchedVersion":"1.69.3","fixReleasedAt":"2026-04-20T01:23:02.554Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:37:02.327Z"}]}}