CVE-2026-42076

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3

Description A command injection issue exists in the extractLLM() function. The function constructs a curl command using string concatenation and passes it to execSync() without proper sanitization. This allows attackers to execute arbitrary shell commands on the server when the corpus parameter contains shell metacharacters, leading to remote code execution.

Recommendations Update to version 1.69.3. As a temporary workaround, restrict or sanitize the input provided to the corpus parameter used in the extractLLM() function.