https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 22:15:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308577 EUVD-2026-308577 https://cve.radiocsirt.org/vuln/euvd-2026-308577 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42076 <p>Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.</p> <p>Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42076 https://cve.radiocsirt.org/vuln/ghsa-j5w5-568x-rq53 <p><strong>Affected:</strong> npm: @evomap/evolver</p> <p>### Summary A command injection vulnerability in the `_extractLLM()` function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to `execSync()` without proper sanitization, enabling remote code execution when the `corpus` parameter contains shell metacharacters.</p> <p>### Details The vulnerability exists in `src/gep/signals.js` at lines 260-274:</p> <p>```javascript // src/gep/signals.js:260-274 function _extractLLM(corpus, nodeSecret, hubUrl) { // ... var url = getHubUrl(hubUrl) + &#39;/gep/extract&#39;; var postData = JSON.stringify({ corpus_summary: summary }); // VULNERABLE: String concatenation into shell command var curlCmd = &#39;curl -s -m 10 -X POST&#39; + &#39; -H &#34;Content-Type: application/json&#34;&#39; + &#39; -H &#34;Authorization: Bearer &#39; + nodeSecret + &#39;&#34;&#39; + &#39; -d &#39; + JSON.stringify(postData).replace(/&#39;/g, &#34;&#39;\\&#39;&#39;&#34;) + &#39; &#39; + JSON.stringify(url);</p> <p>// VULNERABLE: Executes shell command stdout = execSync(curlCmd, { timeout: 12000, encoding: &#39;utf8&#39; }); // ... } ```</p> <p>The `corpus` parameter is derived from user input (via `userSnippet` in `extractSignals()` function) and flows through to `_extractLLM()` where it becomes part of the shell command. While `JSON.stringify()` escapes some characters, it does not prevent shell command substitution via `$(...)` syntax when the resulting string is passed to `execSync()`.</p> <p>The `extractSignals()` function is called from the main evolution loo…</p> <p><strong>Affected:</strong> npm: @evomap/evolver</p> <p>### Summary A command injection vulnerability in the `_extractLLM()` function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to `execSync()` without proper sanitization, enabling remote code execution when the `corpus` parameter contains shell metacharacters.</p> <p>### Details The vulnerability exists in `src/gep/signals.js` at lines 260-274:</p> <p>```javascript // src/gep/signals.js:260-274 function _extractLLM(corpus, nodeSecret, hubUrl) { // ... var url = getHubUrl(hubUrl) + &#39;/gep/extract&#39;; var postData = JSON.stringify({ corpus_summary: summary }); // VULNERABLE: String concatenation into shell command var curlCmd = &#39;curl -s -m 10 -X POST&#39; + &#39; -H &#34;Content-Type: application/json&#34;&#39; + &#39; -H &#34;Authorization: Bearer &#39; + nodeSecret + &#39;&#34;&#39; + &#39; -d &#39; + JSON.stringify(postData).replace(/&#39;/g, &#34;&#39;\\&#39;&#39;&#34;) + &#39; &#39; + JSON.stringify(url);</p> <p>// VULNERABLE: Executes shell command stdout = execSync(curlCmd, { timeout: 12000, encoding: &#39;utf8&#39; }); // ... } ```</p> <p>The `corpus` parameter is derived from user input (via `userSnippet` in `extractSignals()` function) and flows through to `_extractLLM()` where it becomes part of the shell command. While `JSON.stringify()` escapes some characters, it does not prevent shell command substitution via `$(...)` syntax when the resulting string is passed to `execSync()`.</p> <p>The `extractSignals()` function is called from the main evolution loo…</p> https://cve.radiocsirt.org/vuln/ghsa-j5w5-568x-rq53