HighVulnerability
CVE-2026-42075: Evolver path traversal in skill download fetch command via --out flag
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-42075
- Published
- Record updated
- Affected
- @evomap/evolver < 1.69.3
- Fixed in
- 1.69.3
- released April 19, 2026, 14 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
CVE-2026-42075 affects Evolver, a GEP-powered self-evolving engine for AI agents, prior to version 1.69.3. A path traversal flaw (CWE-22) in the skill download (fetch) command accepts unvalidated paths through the --out= flag, allowing attackers to write files to arbitrary filesystem locations. The source says this can overwrite critical system files or create files in sensitive locations.
Mitigation
This issue has been patched in version 1.69.3.
Topics
Related items
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
- MediumOn the hunt for ARTEX: understanding agentic attacks in AWS environmentsSimilar attack · Datadog Security Labs
- CriticalCVE-2026-102895: GPUStack Improper Authentication VulnerabilitySimilar attack · CISA Known Exploited Vulnerabilities
- HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database