Evolver vulnerabilities

Evolver is an AI self-evolving engine that prior to version 1.69.3 had a command injection vulnerability in the _extractLLM() function. This allows attackers to execute arbitrary shell commands on the server due to improper handling of parameters.

In Evolver prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The _applyUpdate() and _updateRecord() functions use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype.

Evolver is an AI engine that prior to version 1.69.3 had a path traversal vulnerability in the skill download command. Attackers could write files to arbitrary locations on the filesystem, posing a risk of overwriting critical system files.