CVE-2026-77930

Critical

Description

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.

SeverityCritical

CVSS9.8

Exploit probability—

ProductEvoScientist

PublishedOct 20, 2026

First seenOct 20, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

EvoScientist EvoScientist0.2.5 or later

Patches

github.com/EvoScientist/EvoScientist/commit/d249e320bd856a7d31d859cfbb2bf75bab6c8686

Vendor advisories

github.com/EvoScientist/EvoScientist/releases/tag/v0.2.5

Affected products

Product	Affected versions	Fixed in
EvoScientist EvoScientist	0.1.0 ≤ v < 0.2.5	0.2.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.