Approval Bypass in EvoScientist Product by EvoScientist
CVE-2026-77930

8.7HIGH

Key Information:

Vendor: Evoscientist
Status: Evoscientist
Vendor: CVE Published:; 20 October 2026

🔔 Create Evoscientist Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77930?

EvoScientist version 0.1.0 and prior is susceptible to an approval bypass vulnerability that permits attackers to execute host shell commands. This is achieved by delegating tasks to async sub-agents that bypass essential security controls. Attackers can embed malicious instructions within ingested content, such as web pages, allowing the compromised agent to invoke the start_async_task function. Consequently, commands are executed with user privileges, exposing critical environment secrets and escalating the risk of exploitation.

Affected Version(s)

EvoScientist 0.1.0 < 0.2.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77930 - Proof of Concept