Live › vulnerability › CVE-2026-77930
Go to dashboardEvoScientist 0.1.0 to 0.2.4: async sub-agents (scheduler, data-analysis, writing) are built in subagents/_factory.py build_async_subagent_graph() with no interrupt_on and no excluded_tools, so deepagents auto-gives them a host execute tool, guarded only by a 7-entry denylist (sudo, chmod, chown, mkfs, dd, shutdown, reboot). Web pages or channel messages the agent ingests can inject instructions that run shell commands as the process owner and read environment secrets. Worst in the documented 'EvoSci serve --auto-approve' deployment with messaging channels. Upstream issue #387 says sync sub-agents (planner, code, debug, research) were also ungated. Vendor rating 9.3 (VulnCheck CVSS4); Lasso rates 9.9. No known exploitation; Lasso's PoC is a benign canary running id.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| EvoScientist | github | >= 0.1.0, < 0.2.5 | 0.2.5 |
pip show EvoScientist (or check the installed version); anything below 0.2.5 is affectedEvoSci serve --auto-approve or auto_mode, or connect messaging channels (WeChat/WeCom, Feishu)0.2.5 or later (current release line is 0.3.x). 0.2.5 adds interrupt_on gating for main and sync sub-agents, a backend guard that refuses pipe-into-interpreter commands (curl | bash) for async sub-agents and relays the refusal to the orchestrator, and per-segment shell_allow_list matchingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-77930")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.