{"id":"CVE-2026-77930","kind":"vulnerability","aliases":["CVE-2026-77930"],"related":[],"title":"EvoScientist: approval bypass lets web content run host shell commands","description":"EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.","summary":"EvoScientist 0.1.0 to 0.2.4: async sub-agents (scheduler, data-analysis, writing) are built in subagents/_factory.py build_async_subagent_graph() with no interrupt_on and no excluded_tools, so deepagents auto-gives them a host execute tool, guarded only by a 7-entry denylist (sudo, chmod, chown, mkfs, dd, shutdown, reboot). Web pages or channel messages the agent ingests can inject instructions that run shell commands as the process owner and read environment secrets. Worst in the documented 'EvoSci serve --auto-approve' deployment with messaging channels. Upstream issue #387 says sync sub-agents (planner, code, debug, research) were also ungated. Vendor rating 9.3 (VulnCheck CVSS4); Lasso rates 9.9. No known exploitation; Lasso's PoC is a benign canary running id.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EvoScientist","fixed":["0.2.5"],"affected":">= 0.1.0, < 0.2.5","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","deepagents","evoscientist","langgraph","prompt-injection","self-hosted","web-browsing-agents"],"not_affected_if":["auto-approve-off-and-no-async-subagents","version-0.2.5-or-later"],"how_to_check":"Run 'pip show EvoScientist' (or check the installed version); anything below 0.2.5 is affected. Highest risk if you run 'EvoSci serve --auto-approve' or auto_mode, or connect messaging channels (WeChat/WeCom, Feishu). Check if your config uses async sub-agents (scheduler, data-analysis, writing). No dedicated check command is published.","fix":"Upgrade to EvoScientist 0.2.5 or later (current release line is 0.3.x). 0.2.5 adds interrupt_on gating for main and sync sub-agents, a backend guard that refuses pipe-into-interpreter commands (curl | bash) for async sub-agents and relays the refusal to the orchestrator, and per-segment shell_allow_list matching. Mitigation: disable --auto-approve, don't expose channels to untrusted senders, run code execution in a Docker sandbox backend. Rotate API keys and tokens in the environment of any host that ran a vulnerable version on untrusted content.","status":"open","published_at":"2026-10-20T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:42+00:00","updated_at":"2026-10-23T23:05:57+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:39:42Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade EvoScientist to 0.2.5 or later.\nRotate any secrets held in environment variables on hosts where a vulnerable version ran agents that fetched web content.","reach":"internet","title":"EvoScientist: approval bypass lets web content run host shell commands","impact":"high","summary":"EvoScientist versions 0.1.0 before 0.2.5 let async sub-agents run shell commands without the approval gate that the main agent uses. An attacker who plants instructions in a fetched web page can make the agent run commands with the user's privileges and read environment secrets.","category":"ai-tooling","who_cares":["evoscientist","ai-agents","web-browsing-agents"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs host shell commands and reads environment secrets as the user.","analyst_note":"Confirm the exact sub-agent and interrupt_on configuration that is vulnerable and whether a check command exists; see https://nvd.nist.gov/vuln/detail/CVE-2026-77930.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-0.2.5-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000518,"input_tokens":2970,"output_tokens":442,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact sub-agent and interrupt_on configuration that is vulnerable and whether a check command exists; see https://nvd.nist.gov/vuln/detail/CVE-2026-77930.","search":"'-2026':12A,15A '-77930':13A,16A '0.1.0':38B,162C '0.2.4':40B '0.2.5':164C '387':128B '7':80B '9.3':143B '9.9':148B 'agent':20B,36B,44B,96B,133B,185C,205C 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':171C 'also':139B 'analysi':48B 'approv':2A,121B,167C 'async':41B,55B,182C,208C 'attack':172C,191C 'auto':69B,120B 'auto-approv':119B 'auto-g':68B 'benign':157B 'brows':35B 'build':54B 'built':51B 'bypass':3A,168C 'call':206C 'canari':158B 'channel':93B,125B 'chmod':84B 'chown':85B 'code':135B 'command':10A,104B,177C,212C 'contain':165C 'content':6A,197C 'cve':11A,14A 'cvss4':145B 'data':47B 'data-analysi':46B 'dd':87B 'debug':136B 'deepag':24B,67B 'deleg':179C 'denylist':82B 'deploy':122B 'document':116B 'entri':81B 'environ':111B,217C 'evosci':117B 'evoscientist':1A,17A,25B,37B,161C 'exclud':64B 'execut':74B 'exploit':151B 'fetch':200C 'gate':190C 'give':70B 'graph':57B 'guard':76B 'host':8A,32B,73B,175C 'id':160B 'ingest':97B,196C 'inject':29B,99B 'instruct':100B,194C 'interrupt':60B,188C 'issu':127B 'known':150B 'lack':186C 'langgraph':26B 'lasso':146B,152B 'let':4A 'messag':94B,124B 'mkfs':86B 'owner':108B 'page':91B,202C 'planner':134B 'plant':193C 'poc':154B 'privileg':215C 'process':107B 'prompt':28B 'prompt-inject':27B 'rate':142B,147B 'read':110B 'reboot':89B 'research':137B 'run':7A,102B,159B,174C,211C 'say':129B 'schedul':45B 'secret':112B,218C 'self':31B 'self-host':30B 'serv':118B 'shell':9A,103B,176C 'shutdown':88B 'start':207C 'sub':43B,132B,184C 'sub-ag':42B,131B,183C 'subag':56B 'subagents/_factory.py':53B 'sudo':83B 'sync':130B 'task':209C 'tool':23B,65B,75B 'ungat':140B 'upstream':126B 'user':214C 'vendor':141B 'vulncheck':144B 'vulner':169C 'web':5A,34B,90B,201C 'web-browsing-ag':33B 'worst':113B 'write':49B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-77930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77930","severity":null,"published_at":"2026-10-20T01:17:19+00:00","modified_at":"2026-10-22T22:18:45+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77930:366","url":null,"severity":null,"published_at":"2026-10-23T23:05:57+00:00","modified_at":"2026-10-23T23:05:57+00:00","first_seen_at":"2026-10-23T23:05:57+00:00","fetched_at":"2026-10-23T23:05:57+00:00","note":"Read VulnCheck advisory, Lasso write-up (root cause, benign PoC, no known exploit), upstream issue #387 and v0.2.5 release. The 0.2.5 fix is a guard that blocks only the pipe-into-interpreter/network set for async agents, not all shell; the issue is closed as an enhancement. Of the 4 X posts found, none were worth saving. No published check command, so how-to-check is a version check. Fixed ecosystem name not verified (used github)."}],"documents":[{"id":1559,"url":"https://www.vulncheck.com/advisories/evoscientist-0.1.0-before-0.2.5-human-approval-bypass-via-async-sub-agents","title":"VulnCheck: EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1560,"url":"https://www.lasso.security/vulnerability-database/cve-2026-77930","title":"Lasso: Ungated Host Shell Execution in Async Sub-Agents (root cause, PoC)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1561,"url":"https://github.com/EvoScientist/EvoScientist/releases/tag/v0.2.5","title":"EvoScientist v0.2.5 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1562,"url":"https://github.com/EvoScientist/EvoScientist/issues/387","title":"EvoScientist #387: HITL sub-agent shell execution never approved","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}