EvoScientist: Approval bypass via async sub-agents allows host command execution

Summary

EvoScientist versions 0.1.0 before 0.2.5 contain an approval bypass in asynchronous sub-agents, which do not enforce the human-in-the-loop approval gate. An attacker can plant instructions in content the agent ingests, such as fetched web pages or messages from chat channels, causing the agent to run shell commands on the host with the privileges of the user running it. Commands can access environment secrets such as API keys and cloud credentials. The CVE record lists no authentication required; the vendor's release notes say the fix is in version 0.2.5.

Affected

• EvoScientist 0.1.0 up to but not including 0.2.5
• Default configuration: unaffected (according to the CVE record)
• VulDB describes the range as up to 0.2.4

Fixed in

• Version 0.2.5 (human-in-the-loop approval now covers sync and async sub-agents)

Workaround

• No vendor workaround documented; upgrading is the recommended action.
• Interim measures from a third-party analysis: disable auto-approve and sandbox code execution until the upgrade is done.
• Running the agent in a container may limit the shell access, but this has not been verified against this flaw.

Exploitation

• No exploitation in the wild found; CISA SSVC lists exploitation as PoC and automatable as yes.
• A public technical write-up by Lasso exists; its reproduction used a benign command.
• Not listed in CISA KEV at the time of research.

Our recommendation

• Inventory all EvoScientist installations, including test and research systems.
• Upgrade to version 0.2.5 or later.
• Until upgraded, disable auto-approve, run the agent in a container, and restrict access to its messaging channels.
• Rotate API keys and secrets that were present on affected hosts.
• Monitor NVD for re-analysis, as the severity scores differ between sources.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (VulnCheck advisory) www.vulncheck.com
• EvoScientist release v0.2.5 github.com
• Fix commit d249e320 github.com
• Lasso vulnerability analysis www.lasso.security
• Vulnerable code (_factory.py) github.com
• OSV entry osv.dev
• GitHub issue #387 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:11.