CVE-2026-77930

LOWCVSS 8.7 · HIGH

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Harsha Hegde@HarshaHegde021h
All 13 👇 DB-GPT: CVE-2026-77932 (9.8), CVE-2026-77933 (9.8) Letta: CVE-2026-77936 (9.8), CVE-2026-77937 Langchain-Chatchat: CVE-2026-75128 (9.8) piflow: CVE-2026-109442 (9.8) Coze Studio: CVE-2026-77934, CVE-2026-77935 Aix-DB: CVE-2026-77926 OpenSRE: CVE-2026-109444 JoySafeter: CVE-2026-109443 EvoScientist: CVE-2026-77930 LangAlpha: CVE-2026-109440 only coze studio has a fix so far (0.5.0) Full breakdown: https://severitydaily.com/ai-agent-frameworks-thirteen-records-vulncheck-lasso-cwe-306-cwe-1188-shipped-defaults-no-fixed-version/
0000056
14 followersView on X

Explore more

Back to dashboard