Security: EvoMap/evolver
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unbounded request body in proxy /asset/submit causes persistent disk-exhaustion DoSGHSA-7xp7-m392-h92c published
Apr 27, 2026 by autogame-17Moderate -
Validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scriptsGHSA-jxh8-jh77-xh6g published
Apr 27, 2026 by autogame-17High -
Path traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)GHSA-cfcj-hqpf-hccf published
Apr 27, 2026 by autogame-17High -
Prototype Pollution via `Object.assign()` in mailbox store operationsGHSA-2cjr-5v3h-v2w4 published
Apr 20, 2026 by autogame-17Moderate -
Path Traversal via `--out` flag in `fetch` command allows Arbitrary File WriteGHSA-r466-rxw4-3j9j published
Apr 20, 2026 by autogame-17High -
Command Injection via `execSync` in `_extractLLM()` function allows Remote Code ExecutionGHSA-j5w5-568x-rq53 published
Apr 20, 2026 by autogame-17Critical