CriticalVulnerability
CVE-2026-42076: Evolver command injection in _extractLLM() via corpus parameter
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-42076
- Published
- Record updated
- Affected
- @evomap/evolver < 1.69.3
- Fixed in
- 1.69.3
- released April 19, 2026, 14 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.7%
Summary
CVE-2026-42076 affects Evolver, a GEP-powered self-evolving engine for AI agents, prior to version 1.69.3. A command injection flaw in the _extractLLM() function builds a curl command by string concatenation and passes it to execSync() without sanitization. When the corpus parameter contains shell metacharacters, an attacker can execute arbitrary shell commands on the server, classified as CWE-78.
Mitigation
This issue has been patched in version 1.69.3.
Topics
Related items
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
- MediumOn the hunt for ARTEX: understanding agentic attacks in AWS environmentsSimilar attack · Datadog Security Labs
- CriticalCVE-2026-102895: GPUStack Improper Authentication VulnerabilitySimilar attack · CISA Known Exploited Vulnerabilities
- HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database