Threats tagged 'ghsa-j5w5-568x-rq53'

A command injection vulnerability in the _extractLLM() function of the @evomap/evolver package allows remote attackers to execute arbitrary shell commands. The vulnerability arises from unsafe string concatenation of user-controlled input into a curl command executed via execSync() without proper sanitization. This enables remote code execution with the privileges of the Node.js process. The issue affects versions prior to 1.69.3 and has a critical severity score of 9.8. A fix is available in version 1.69.3.