Evoscientist
Monthly
EvoScientist 0.1.0 up to (but not including) 0.2.5 lets an attacker reach host shell execution by delegating work to async sub-agents that carry no human-approval gate: instructions planted in ingested content such as a fetched web page can cause the agent to call start_async_task, and the resulting commands run with the invoking user's OS privileges and environment secrets. The bypass is a missing-authorization flaw (CWE-862) in the approval wiring rather than a credentials attack - per CVSS 4.0 (AV:N/AC:L/PR:N/UI:N, all impact metrics High) and our assessed CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) it is unauthenticated and requires no user interaction beyond the agent processing the poisoned content, and per the fix the vulnerable async thread lacks any approval path at all, so exploitation does not depend on auto_approve being enabled. A public PoC reference exists; it is not verified as working exploit code, EPSS is low at 0.44% (37th percentile), SSVC marks exploitation as 'poc' with automatable/total technical impact, and the vuln.today decision label is act_now with a vendor fix in v0.2.5.
EvoScientist 0.1.0 up to (but not including) 0.2.5 lets an attacker reach host shell execution by delegating work to async sub-agents that carry no human-approval gate: instructions planted in ingested content such as a fetched web page can cause the agent to call start_async_task, and the resulting commands run with the invoking user's OS privileges and environment secrets. The bypass is a missing-authorization flaw (CWE-862) in the approval wiring rather than a credentials attack - per CVSS 4.0 (AV:N/AC:L/PR:N/UI:N, all impact metrics High) and our assessed CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) it is unauthenticated and requires no user interaction beyond the agent processing the poisoned content, and per the fix the vulnerable async thread lacks any approval path at all, so exploitation does not depend on auto_approve being enabled. A public PoC reference exists; it is not verified as working exploit code, EPSS is low at 0.44% (37th percentile), SSVC marks exploitation as 'poc' with automatable/total technical impact, and the vuln.today decision label is act_now with a vendor fix in v0.2.5.