CVE-2026-42076

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42076", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-23T19:17:30.565Z", "datePublished": "2026-05-04T16:48:51.446Z", "dateUpdated": "2026-05-05T14:14:58.325Z"}, "containers": {"cna": {"title": "Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53"}, {"name": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"}], "affected": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"version": "< 1.69.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T16:48:51.446Z"}, "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3."}], "source": {"advisory": "GHSA-j5w5-568x-rq53", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-05T13:06:18.539490Z", "id": "CVE-2026-42076", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T14:14:58.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42076", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-05T13:06:18.539490Z"}}}], "references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T13:06:29.754Z"}}], "cna": {"title": "Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution", "source": {"advisory": "GHSA-j5w5-568x-rq53", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"status": "affected", "version": "< 1.69.3"}]}], "references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "name": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "name": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T16:48:51.446Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42076", "state": "PUBLISHED", "dateUpdated": "2026-05-05T14:14:58.325Z", "dateReserved": "2026-04-23T19:17:30.565Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T16:48:51.446Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "evolver", "vendor": "EvoMap", "versions": [{"status": "affected", "version": "< 1.69.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3."}, {"lang": "es", "value": "Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versi\u00f3n 1.69.3, una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n _extractLLM() permite a los atacantes ejecutar comandos de shell arbitrarios en el servidor. La funci\u00f3n construye un comando curl utilizando concatenaci\u00f3n de cadenas y lo pasa a execSync() sin la sanitizaci\u00f3n adecuada, lo que permite la ejecuci\u00f3n remota de c\u00f3digo cuando el par\u00e1metro corpus contiene metacaracteres de shell. Este problema ha sido parcheado en la versi\u00f3n 1.69.3."}], "id": "CVE-2026-42076", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42076", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-05T13:06:18.539490Z", "version": "2.0.3"}}]}, "published": "2026-05-04T17:16:24.440", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.69.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "evolver", "source": "cna", "vendor": "EvoMap"}, "product": "evolver", "vendor": "evomap"}], "created": "2026-05-04T18:45:06.427810+00:00", "updated": "2026-10-25T19:15:16.923846+00:00", "vendors": ["evomap", "evomap$PRODUCT$evolver"]}