Executive brief
EvoMap evolver is a Node.js-based tool for fetching and managing AI "skills" from a Hub service. A path traversal vulnerability in the `evolver fetch` command allows a malicious Hub to overwrite arbitrary project files (including the entry point itself) with attacker-controlled code, leading to remote code execution when the evolver runs subsequent commands.
Technical details
The vulnerability is a path traversal in the default (non-`--out`) branch of the `evolver fetch` subcommand. The `safeId` sanitization regex permits dot characters ([^a-zA-Z0-9_\-\.]), so a skill_id of `..` passes through unchanged. Combined with `path.join('.', 'skills', '..')` which collapses to `.` (the current working directory), files are written to cwd instead of the intended `./skills/` subdirectory. The traversal check (path.relative verification) only applies when `--out` is explicitly used, leaving the documented default case vulnerable. An attacker-controlled Hub can supply `bundled_files` containing JavaScript (.js), JSON (.json), shell (.sh), or Python (.py) files that overwrite legitimate project files like `index.js` or `package.json`. The response is trusted without signature verification, and any Hub participant can set a skill_id to `..`. The vulnerability allows arbitrary code execution on next invocation of the evolver.
Affected products
- EvoMap evolver <= 1.70.0-beta.4
Timeline
- 2026-05-05: disclosed
- 2026-04-27: patched: Patched in version 1.70.0-beta.5