CVE-2026-77930 — EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an inte…
Published: 2026-10-20 · CVSS: 9.3 · CVSS 4.0
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7