Evolver, a self‑evolving AI engine, contains a command injection flaw. The _extractLLM() function builds a curl command by concatenating strings derived from the corpus input and passes it to execSync() without escaping. This flaw permits an attacker to inject shell metacharacters. The resulting arbitrary command runs with the privileges of the running Evolver process, giving complete control of the host machine. The flaw is a classic example of CWE‑78 (Command Injection).

The affected product is EvoMap Evolver. Versions earlier than 1.69.3 are vulnerable; the issue was fixed in 1.69.3 and later releases are not affected.

The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score of 1% indicates a low, but non‑zero, likelihood that the vulnerability will be targeted. It is not currently listed in the CISA KEV catalog, so no publicly known exploits exist at this time. The attack vector is remote, inferred from the ability of an attacker to supply a crafted corpus parameter. Once a suitable input is processed, the attacker can execute arbitrary commands with the same privileges as the Evolver process.