CVE-2026-42075 Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download fetch command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabli...

Evolver 安全漏洞

Evolver is an intelligent agent-based self-evolution tool developed by EvoMap. Versions of Evolver prior to 1.69.3 contained security vulnerabilities. These vulnerabilities were caused by a prototype contamination issue in the email storage module, which could allow attackers to modify the behavi...

Evolver 操作系统命令注入漏洞

Evolver is an intelligent agent-based self-evolution tool developed by EvoMap. Versions of Evolver prior to 1.69.3 contained a vulnerability related to operating system command injection. This vulnerability stemmed from issues with command injection in the extractLLM function, which could allow...

Evolver 路径遍历漏洞

Evolver is an intelligent agent-based self-evolution tool developed by EvoMap. Versions of Evolver prior to 1.69.3 contained a path traversal vulnerability. This vulnerability stemmed from issues with path traversal in skill download commands, which could allow attackers to write files to any...

PT-2026-36853

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3 Description A path traversal issue exists in the skill download fetch command. The --out= flag accepts user-provided paths without proper validation, allowing attackers to write files to arbitrary locations on...

PT-2026-36855

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3 Description A prototype pollution issue in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The flaw occurs...

Directory Traversal

Overview @evomap/evolver is an A GEP-powered self-evolution engine for AI agents. Features automated log analysis and Genome Evolution Protocol GEP for auditable, reusable evolution assets. Affected versions of this package are vulnerable to Directory Traversal via the --out flag in the fetch cal...

Command Injection

Overview @evomap/evolver is an A GEP-powered self-evolution engine for AI agents. Features automated log analysis and Genome Evolution Protocol GEP for auditable, reusable evolution assets. Affected versions of this package are vulnerable to Command Injection via the extractLLM function. An...

PT-2026-36854

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3 Description A command injection issue exists in the extractLLM function. The function constructs a curl command using string concatenation and passes it to execSync without proper sanitization. This allows...

evolver

🧬 Evolver !GitHub starshttps://img.shields.io/github/star...

Beijing Evolver Robotics Fatty App Client Has Overstepping Vulnerabilities

Beijing Evolver Robotics Technology Co., Ltd. is engaged in the research and development of intelligent robots for home and commercial use, and has developed two versions of intelligent robots for home and commercial use, FABO. Beijing Evolver Robotics FABO app client has an overstepping...

DecisionTools SharpGrid ActiveX Control RCE

Exploit for windows platform in category dos / poc Application: DecisionTools SharpGrid ActiveX Control Code Execution Vulnerability Platforms: Windows Secunia: SA48571 Date: 2012-05-09 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter:...