{"id":"EUVD-2026-27009","revision":"01fddaac97c24f8c8883cb0601fdd68a","records":[{"revision":"01fddaac97c24f8c8883cb0601fdd68a","observedAt":"2026-11-05T09:00:41.193+00:00","statement":{"source":"euvd","id":"EUVD-2026-27009","aliases":["CVE-2026-42076"],"title":"Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function construct…","description":"Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization, enabling remote code execution when the corpus parameter contains shell metacharacters. This issue has been patched in version 1.69.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":null}],"references":["https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53","https://github.com/EvoMap/evolver/releases/tag/v1.69.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27009","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 4, 2026, 4:48:51 PM","dateUpdated":"May 5, 2026, 2:14:58 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-27009","identifiers":["EUVD-2026-27009","CVE-2026-42076"]},"retained":false,"historicalAffected":[]}],"coverage":[]}