PT-2026-36854 · Evolve · Evolver

Xeloxa · Published 2026-04-22 · Updated 2026-05-13 · CVE-2026-42076

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3

Description A command injection issue exists in the extractLLM() function. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization. This allows attackers to execute arbitrary shell commands on the server when the corpus parameter contains shell metacharacters, leading to remote code execution.

Recommendations Update to version 1.69.3. As a temporary workaround, restrict or sanitize the input provided to the corpus parameter used in the extractLLM() function.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42076

GHSA-J5W5-568X-RQ53

Affected Products

Evolver

References · 9

• 🔥 https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42076 · Security Note
• https://osv.dev/vulnerability/GHSA-j5w5-568x-rq53 · Vendor Advisory
• https://github.com/EvoMap/evolver · Note
• https://github.com/EvoMap/evolver/releases/tag/v1.69.3 · Note
• https://twitter.com/lyrie_ai/status/2054373544931307836 · Twitter Post
• https://twitter.com/CVEnew/status/2051361274320101480 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054373545791119854 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051444612850389285 · Twitter Post