---
id: "CVE-2026-77930"
kind: "vulnerability"
aliases: ["CVE-2026-77930"]
title: "EvoScientist: approval bypass lets web content run host shell commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "EvoScientist", "fixed": ["0.2.5"], "affected": ">= 0.1.0, < 0.2.5", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "deepagents", "evoscientist", "langgraph", "prompt-injection", "self-hosted", "web-browsing-agents"]
not_affected_if: ["auto-approve-off-and-no-async-subagents", "version-0.2.5-or-later"]
published_at: "2026-10-20T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T23:05:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77930", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:05:57+00:00"}]
---

# EvoScientist: approval bypass lets web content run host shell commands

EvoScientist 0.1.0 to 0.2.4: async sub-agents (scheduler, data-analysis, writing) are built in subagents/_factory.py build_async_subagent_graph() with no interrupt_on and no excluded_tools, so deepagents auto-gives them a host execute tool, guarded only by a 7-entry denylist (sudo, chmod, chown, mkfs, dd, shutdown, reboot). Web pages or channel messages the agent ingests can inject instructions that run shell commands as the process owner and read environment secrets. Worst in the documented 'EvoSci serve --auto-approve' deployment with messaging channels. Upstream issue #387 says sync sub-agents (planner, code, debug, research) were also ungated. Vendor rating 9.3 (VulnCheck CVSS4); Lasso rates 9.9. No known exploitation; Lasso's PoC is a benign canary running id.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:EvoScientist affected >= 0.1.0, < 0.2.5 fixed 0.2.5

## How to check

Run 'pip show EvoScientist' (or check the installed version); anything below 0.2.5 is affected. Highest risk if you run 'EvoSci serve --auto-approve' or auto_mode, or connect messaging channels (WeChat/WeCom, Feishu). Check if your config uses async sub-agents (scheduler, data-analysis, writing). No dedicated check command is published.

## Fix

Upgrade to EvoScientist 0.2.5 or later (current release line is 0.3.x). 0.2.5 adds interrupt_on gating for main and sync sub-agents, a backend guard that refuses pipe-into-interpreter commands (curl | bash) for async sub-agents and relays the refusal to the orchestrator, and per-segment shell_allow_list matching. Mitigation: disable --auto-approve, don't expose channels to untrusted senders, run code execution in a Docker sandbox backend. Rotate API keys and tokens in the environment of any host that ran a vulnerable version on untrusted content.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77930
- 2026-10-23T23:05:57+00:00 analyst — Read VulnCheck advisory, Lasso write-up (root cause, benign PoC, no known exploit), upstream issue #387 and v0.2.5 release. The 0.2.5 fix is a guard that blocks only the pipe-into-interpreter/network set for async agents, not all shell; the issue is closed as an enhancement. Of the 4 X posts found, none were worth saving. No published check command, so how-to-check is a version check. Fixed ecosystem name not verified (used github).

## Documents

- [advisory] VulnCheck: EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents https://www.vulncheck.com/advisories/evoscientist-0.1.0-before-0.2.5-human-approval-bypass-via-async-sub-agents
- [describes] EvoScientist #387: HITL sub-agent shell execution never approved https://github.com/EvoScientist/EvoScientist/issues/387
- [fix] EvoScientist v0.2.5 release notes https://github.com/EvoScientist/EvoScientist/releases/tag/v0.2.5
- [poc] Lasso: Ungated Host Shell Execution in Async Sub-Agents (root cause, PoC) https://www.lasso.security/vulnerability-database/cve-2026-77930

## From the sources

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_