Approved changes feed: RSS · Atom
cpe:2.3:a:evomap:evolver:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Evomap (d20d20b8-8a51-57ed-9519-fb248a3cccc7) |
|---|---|
| Product | Evolver (ea938e01-42f0-5b05-8121-c3edf82d0224) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42077 |
vulnerable | 2026-06-08 08:03:15.904058 |
Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations
MEDIUM (5.2)
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.
Published: 2026-05-04T16:50:15.167Z
Updated: 2026-05-06T13:40:54.808Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42076 |
vulnerable | 2026-06-08 08:03:15.903643 |
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
CRITICAL (9.8)
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.
Published: 2026-05-04T16:48:51.446Z
Updated: 2026-05-05T14:14:58.325Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42075 |
vulnerable | 2026-06-08 08:03:15.903246 |
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
HIGH (8.1)
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.
Published: 2026-05-04T16:47:23.943Z
Updated: 2026-05-04T17:15:13.381Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.