External risk intelligence

EvoScientist Approval Bypass Allows Host Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-77930

The vulnerability involves an autonomous agent framework that processes ingested content, such as web pages. While agents often operate in backend or internal analysis environments, the nature of the tool requires interacting with external data, making internet reachability plausible depending on the specific implementation, though it is not inherently a public-facing gateway or identity service.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in the EvoScientist technology that could allow unauthorized execution of commands on a host system. Attackers could potentially leverage compromised content to trick the system into running malicious code with user privileges and access to sensitive information. The primary concern is to determine if this technology is in use and if it is exposed to risks from external content.

Commands can run automatically from untrusted content.
High risk if this technology handles sensitive data.
Confirm usage and exposure to external content.

Attack Path

How an attacker could exploit the issue

An attacker can gain control by submitting malicious content, such as a compromised webpage, to the EvoScientist application. The application's sub-agents will then process this content, leading to the execution of unintended host shell commands with the user's privileges. This can result in sensitive information being exposed or commands being run on the system.

Entry condition: Attacker controls ingested content.
Trigger point: Sub-agents process content without sufficient gating.
Resulting risk: Host commands run with user privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to run host shell commands with user privileges and access environment secrets by planting malicious instructions in content that the agent ingests, such as web pages, when supported by the advisory.

Host shell commands and user environment secrets.
Malicious instructions in ingested content.
Unauthorized command execution and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The EvoScientist platform's approval bypass vulnerability likely falls under the responsibility of the application or platform engineering teams, as it affects the core functionality of autonomous agents. The first practical step is to inventory all instances of EvoScientist, assess their exposure and criticality, identify the accountable owner for each, and then plan remediation according to risk.

Application or platform teams should own.
Verify agent reachability and criticality first.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is EvoScientist?

EvoScientist is an autonomous agent framework designed to perform automated research tasks. It functions by ingesting external data, such as web pages, and delegating specific duties to sub-agents. These agents process content to assist with complex workflows, but this automation relies on its internal logic to safely handle and execute instructions derived from the data it retrieves.

How does this CVE-2026-77930 approval bypass work?

This vulnerability is classified as CWE-862, which is an improper authorization weakness. In EvoScientist, certain sub-agents lack an 'interrupt_on' gate, which is a security check intended to pause or verify actions. Because this control is missing, the system mistakenly approves malicious instructions found within ingested content, allowing those commands to run directly on the host system.

Does viewing any web page trigger the vulnerability?

No. Simply browsing to a site is not enough. The vulnerability is triggered specifically when the EvoScientist agent ingests and processes content that contains malicious, planted instructions. If the agent does not perform an autonomous task involving that specific content or if it lacks the capability to interpret the injected commands as executable code, the trigger path is not completed.

Is my EvoScientist instance at risk according to Halo Surface Signal?

Halo Surface Signal notes that while EvoScientist is not a standard public-facing gateway, its core function is processing external data. Risk depends on your implementation; if your agents are configured to ingest data from the public internet, they are reachable by external content. If your instance is strictly isolated in an internal environment without external data access, the reachability risk is lower.

What should I do to secure my system against this issue?

Begin by identifying all running instances of EvoScientist within your environment to understand where it is deployed and what data it accesses. Once mapped, assess which instances handle sensitive information or environment secrets. Your primary goal is to update the software to version 0.2.5 or later, which includes the necessary gating logic to prevent unauthorized host command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.