Executive brief
Evolver is a Node.js-based skill management tool used to download and manage application skills. A path traversal vulnerability in the fetch command's --out flag allows an attacker with local or network access to write arbitrary files to any location on the filesystem, potentially overwriting critical system files, modifying application code, or installing backdoors that persist across restarts.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the fetch command handler at index.js lines 752–767. The --out= flag value is extracted via String.slice() without any path validation or canonicalization, then passed directly to fs.mkdirSync() and used as a write destination. An attacker can inject directory traversal sequences (e.g., ../../../etc/cron.d) to escape the intended skills directory. The safeId variable sanitizes only the default path, not user-supplied --out paths. Attack vector is network (CLI invocation in automated environments) or local, and requires low privileges to execute the fetch command. Successful exploitation enables arbitrary file write, leading to code execution, file overwrite, or privilege escalation if the process runs elevated. The vulnerability was patched in version 1.69.3 by validating and normalizing the output path.
Affected products
- EvoMap Evolver < 1.69.3
Timeline
- 2026-04-22: disclosed: GHSA-r466-rxw4-3j9j published
- 2026-04-20: advisory: Advisory published by autogame-17
- 2026-04-22: patched: Fixed in version 1.69.3