CVE Intelligence
Analysis AI-assisted

CVE-2026-42076: EvoMap Evolver OS Command Injection in _extractLLM()

CVE-2026-42076 affects Evolver, a self-evolving engine for AI agents, in versions prior to 1.69.3. A command injection flaw in _extractLLM() can allow an attacker to run arbitrary shell commands on the server when the corpus parameter contains shell metacharacters. The record reports a CVSS 3.1 base score of 9.8 (critical) and states that version 1.69.3 contains the fix.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Evolver is described as a GEP-powered self-evolving engine for AI agents. The record states that versions before 1.69.3 contain a command injection flaw in the _extractLLM() function, classified as CWE-78 (OS Command Injection). The fix is stated to be present in version 1.69.3.

Impact

  • The record describes arbitrary shell command execution on the server, which is consistent with the critical rating.
  • The CVSS 3.1 vector in the record indicates a network attack vector, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
  • The flaw is triggered through the corpus parameter when it contains shell metacharacters.

Affected products and versions

  • Product: Evolver (EvoMap/evolver project).
  • Affected: versions prior to 1.69.3, according to the description.
  • The structured affected and fixed fields in the record are empty, so exact version ranges and any backported branches are unknown.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted for this analysis. EPSS values are present (probability 0.02563, percentile 0.84726), but they estimate likelihood and do not confirm activity.

Remediation and mitigation

  • Upgrade Evolver to version 1.69.3 or later, as stated in the record and the project release.
  • Where an upgrade is not immediately possible, restrict who can supply input to the corpus parameter and isolate the service from sensitive systems and credentials.
  • Review configurations and integrations for untrusted input paths that reach the affected function.

Detection guidance

  • Monitor for unexpected child processes spawned by the Evolver service.
  • Look for unusual outbound network connections or file changes originating from the agent host.
  • Audit requests that carry unusual special characters in the corpus field.

Limitations of the available information

The record does not include structured affected version ranges, fixed-version fields or detailed technical analysis from the vendor advisory. Exploit conditions are summarized only at a high level here. The EPSS date in the record is later than the publication date, so the timing of that score should be verified against the source.

Frequently asked questions

Which Evolver versions are affected by CVE-2026-42076?

According to the record, versions prior to 1.69.3 are affected. The structured affected-version fields are empty, so exact ranges are unknown.

Is CVE-2026-42076 known to be exploited in the wild?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

What should administrators do first?

Upgrade Evolver to version 1.69.3 or later. If that is not immediately possible, limit who can supply input to the corpus parameter and isolate the service.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.