EUVD-2026-27009
GHSA-j5w5-568x-rq53
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.
AnalysisAI
Remote code execution in Evolver versions before 1.69.3 allows unauthenticated network attackers to execute arbitrary shell commands via command injection in the _extractLLM() function. Attackers exploit unsanitized corpus parameters passed to execSync() through string concatenation in a curl command, achieving full system compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify and inventory all Evolver deployments with versions prior to 1.69.3 and assess network exposure (prioritize internet-facing instances). Within 7 days: Implement network segmentation and access controls to restrict Evolver service to trusted networks only; monitor for suspicious curl-based command injection attempts in application logs. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today