@evomap/evolver vulnerabilities (npm)
6 vulnerabilities.
-
@evomap/evolvernpm @evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts 8.1 High -
@evomap/evolvernpm @evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS 6.2 Medium -
@evomap/evolvernpm @evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE) 8.8 High -
@evomap/evolvernpm Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write 8.1 High -
@evomap/evolvernpm Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution 9.8 Critical -
@evomap/evolvernpm Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations 5.2 Medium