The vulnerability in EvoScientist allows an attacker to bypass human approval by delegating commands to asynchronous sub‑agents that lack an interrupt_on gate. This flaw lets the attacker embed shell commands within ingested content, such as fetched web pages, which the agent then executes using the host's user privileges and environment secrets.

Affected product is EvoScientist version 0.1.0 through 0.2.4. Versions 0.2.5 and later include the fix that enforces the interrupt_on gate on async sub‑agents.

With a CVSS score of 9.3 the vulnerability is high severity. The EPSS score is <1%, indicating a very low but non‑zero likelihood of exploitation, and the flaw is not listed in CISA's KEV catalog, but remote code execution remains possible if an attacker can influence content that the agent processes. The likely attack vector involves remote content ingestion or manipulation of fetched data to trigger the sub‑agent to run commands. The impact would be full host compromise with access to environment secrets.