EvoScientist EUVD-2026-104687

Requires (1) the EvoScientist agent to ingest attacker-controlled external content - e.g. a fetched web page carrying injected instructions - and (2) the agent to delegate work to an async sub-agent path (the writing-agent or data-analysis-agent graphs per subagents/_factory) that in versions 0.1.0 before 0.2.5 has no human-approval/interrupt_on gate at all, so start_async_task can run host shell commands unattended. Per the fix, the vulnerable async thread lacks any approval path regardless of settings, so exploitation does not depend on auto_approve being enabled. Commands execute with the invoking user's OS privileges and environment secrets. Limiting factors: the attacker must get content into the agent's ingestion/fetch pipeline, the victim must actually run a task that reaches that content and delegates to an async sub-agent, and only versions 0.1.0 up to (not including) 0.2.5 are affected - upgrading to v0.2.5 is the fix.

The signals are largely consistent on technical severity but diverge on real-world urgency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) describes a network-reachable, low-complexity flaw needing no privileges or user interaction and yielding total confidentiality, integrity and availability impact - effectively indirect remote code execution on the host. SSVC reinforces this: Technical Impact 'total' and Automatable 'yes', which fits a prompt-injection vector that can be seeded broadly in web content. However, exploitation status is only SSVC 'poc' and the input states the exploit is a reference not verified as working code, so this is not confirmed active exploitation - it is NOT in CISA KEV. EPSS is low (0.44%, 37th percentile), which conflicts with the vuln.today 'act_now' Decision label; the low EPSS reflects the product's obscurity and the youth of this CVE rather than low technical danger. Net: a genuinely high-impact authorization/approval-bypass flaw whose priority is driven by impact and automatability, not by observed mass exploitation. Note the tag labels this 'Authentication Bypass' while CWE-862 and the description describe a human-approval/authorization bypass - a classification nuance, not an auth-weakness in the login sense.

An attacker publishes (or compromises) a web page containing hidden instructions. When an EvoScientist user runs a research task that fetches that page, the ingested content steers the agent into delegating work to an async sub-agent (e.g. writing-agent or data-analysis-agent) that lacks the interrupt_on human-approval gate; the sub-agent calls start_async_task and runs attacker-chosen host shell commands with the user's privileges and environment secrets. A public PoC reference exists (lasso.security), but it is not verified as working exploit code.