CVE-2026-42075: EvoMap Evolver path traversal in fetch command via --out flag

CVE-2026-42075 · Severity: high · CVSS 8.1 · Published 2026-05-04

Evolver is a Node.js-based skill management tool used to download and manage application skills. A path traversal vulnerability in the fetch command's --out flag allows an attacker with local or network access to write arbitrary files to any location on the filesystem, potentially overwriting critical system files, modifying application code, or installing backdoors that persist across restarts.

Technologies: EvoMap Evolver, @evomap/evolver (npm). Vendors: EvoMap, npm.

Quick answers

Is CVE-2026-42075 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42075 being exploited in the wild.
How severe is CVE-2026-42075?
High severity, with a CVSS score of 8.1, published 4 May 2026.
Which products and versions are affected?
EvoMap Evolver < 1.69.3; @evomap/evolver (npm) SEMVER:introduced=0,fixed=1.69.3.
Is there a fix for CVE-2026-42075?
Yes. @evomap/evolver (npm): upgrade to 1.69.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42075 attacked?
It is attacked over the network or with local access.
Am I affected by CVE-2026-42075?
Check whether you run EvoMap Evolver or @evomap/evolver (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @evomap/evolver (npm): upgrade to 1.69.3 or later
    npm install @evomap/evolver@1.69.3

Technical details

The vulnerability is a classic path traversal (CWE-22) in the fetch command handler at index.js lines 752–767. The --out= flag value is extracted via String.slice() without any path validation or canonicalization, then passed directly to fs.mkdirSync() and used as a write destination. An attacker can inject directory traversal sequences (e.g., ../../../etc/cron.d) to escape the intended skills directory. The safeId variable sanitizes only the default path, not user-supplied --out paths. Attack vector is network (CLI invocation in automated environments) or local, and requires low privileges to execute the fetch command. Successful exploitation enables arbitrary file write, leading to code execution, file overwrite, or privilege escalation if the process runs elevated. The vulnerability was patched in version 1.69.3 by validating and normalizing the output path.

Affected products

  • EvoMap Evolver < 1.69.3

Identifiers

  • CVE-2026-42075
  • GHSA-r466-rxw4-3j9j

Timeline

  • 2026-04-22: disclosed: GHSA-r466-rxw4-3j9j published
  • 2026-04-20: advisory: Advisory published by autogame-17
  • 2026-04-22: patched: Fixed in version 1.69.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.