MEDIUM5.2npm
GHSA-2cjr-5v3h-v2w4· CVE-2026-42077Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations
Modified: 5/5/2026
package
npm/@evomap/evolver
pkg:npm/%40evomap/evolver
MEDIUM6.2npm
GHSA-7xp7-m392-h92c@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
Modified: 5/5/2026
HIGH8.8npm
GHSA-cfcj-hqpf-hccf@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
Modified: 5/5/2026
CRITICAL9.8npm
GHSA-j5w5-568x-rq53· CVE-2026-42076Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
Modified: 5/5/2026
HIGH8.1npm
GHSA-jxh8-jh77-xh6g@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Modified: 5/5/2026
HIGH8.1npm
GHSA-r466-rxw4-3j9j· CVE-2026-42075Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
Modified: 5/5/2026