Skip to content
OpenAdvisories

Product · EvoMap

evolver

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-42076

    Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

    Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command us…

    EvoMap evolver @evomap/evolver npm