evomap/evolver Security Advisories | GitStock

high2026-05-05

@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts

GHSA-jxh8-jh77-xh6g

medium2026-05-05

@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS

GHSA-7xp7-m392-h92c

high2026-05-05

@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)

GHSA-cfcj-hqpf-hccf

high2026-04-22

Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write

GHSA-r466-rxw4-3j9j · CVE-2026-42075

critical2026-04-22

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

GHSA-j5w5-568x-rq53 · CVE-2026-42076

medium2026-04-22

Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations

GHSA-2cjr-5v3h-v2w4 · CVE-2026-42077