npmPackage

@evomap/evolver

3 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-42077Medium 5.2
Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations
Affected: fixed in 1.69.3.
Fixed in 1.69.3 (released Apr 20, 2026, 14 days before disclosure).
The latest release, 2.0.50, is not affected.
1.6% of @evomap/evolver downloads last week were affected versions (118).
CVE-2026-42076Critical 9.8
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
Affected: fixed in 1.69.3.
Fixed in 1.69.3 (released Apr 20, 2026, 14 days before disclosure).
The latest release, 2.0.50, is not affected.
1.6% of @evomap/evolver downloads last week were affected versions (118).
CVE-2026-42075High 8.1
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
Affected: fixed in 1.69.3.
Fixed in 1.69.3 (released Apr 20, 2026, 14 days before disclosure).
The latest release, 2.0.50, is not affected.
1.6% of @evomap/evolver downloads last week were affected versions (118).