A command injection flaw in the _extractLLM() function of the Evolver engine allows an attacker to construct a curl command through string concatenation and pass it to execSync() without sanitizing input. The vulnerability enables execution of arbitrary shell commands on the host server, effectively delivering remote code execution for users who can influence the corpus parameter with shell metacharacters.

The affected product is the EvoMap Evolver engine. Versions earlier than 1.69.3 are vulnerable; the issue was fixed in version 1.69.3 and later versions are not affected.

With a CVSS score of 9.8, the vulnerability is considered critical. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, implying no known exploits at this time. The attack vector is remote, relying on an attacker’s ability to supply a crafted corpus parameter that contains shell metacharacters. Once exploited, the attacker can execute any command with the privileges of the running Evolver process.