EvoMap evolver versions before 1.69.3 contain an OS command injection vulnerability (CWE-78) in the _extractLLM() function. This function builds a curl command by concatenating strings including the corpus parameter, then executes it using execSync() without proper input sanitization. An attacker can exploit this by injecting shell metacharacters into the corpus parameter, leading to arbitrary command execution on the server. The vulnerability has been fixed in version 1.69.3.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands on the server hosting EvoMap evolver, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This can lead to data theft, system manipulation, or denial of service.

Upgrade EvoMap evolver to version 1.69.3 or later, where this vulnerability has been patched. No other mitigation is indicated by the vendor advisory. Patch status is not explicitly stated but the fix is confirmed in version 1.69.3.