GCVE - cpe:2.3:a:evoscientist:evoscientist:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:evoscientist:evoscientist:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Evoscientist (`78eea6a2-b3b2-54d9-b872-4b607cb70191`)
Product	Evoscientist (`8fd125da-ce38-5c7c-9ecb-ce1909d5b58c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-77930`	vulnerable	2026-11-03 10:15:18.010998	EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents CRITICAL (9.8) EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets. Published: 2026-10-20T00:46:10.763Z Updated: 2026-10-22T21:09:21.545Z Open on db.gcve.eu Reference links https://www.lasso.security/vulnerability-database/cve-2026-77930 https://github.com/EvoScientist/EvoScientist/issues/387 https://github.com/EvoScientist/EvoScientist/commit/d249e320bd856a7d31d859cfbb2bf75bab6c8686 https://github.com/EvoScientist/EvoScientist/releases/tag/v0.2.5 https://github.com/EvoScientist/EvoScientist/blob/ac58caab7bdd1706f3fee55891f611cd175d05b0/EvoScientist/subagents/_factory.py#L116	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.