Approval Bypass in EvoScientist Allows Shell Command Execution

Executive Summary

This vulnerability is an approval bypass in EvoScientist 0.1.0 before 0.2.5. It allows attackers to run host shell commands by delegating them to async sub-agents that lack an interrupt_on gate. Attackers can inject commands via untrusted content like web pages, which the agent executes with user privileges and access to environment secrets.

Useful 0 Not Useful 0

Detection Guidance

Check EvoScientist version with pip show evoscientist or grep version in installed files. Monitor for unauthorized async sub-agent tasks via logs or system processes. Look for suspicious commands like curl piping to bash or recursive file deletions in agent outputs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary shell commands on your system with your user privileges. This could lead to data theft, system compromise, or further network attacks. Commands run with access to your environment secrets, increasing the risk of credential exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to EvoScientist 0.2.5 or later immediately. Disable auto-approve for all agents. Implement strict input validation for ingested content. Block dangerous commands like sudo or rm -rf via configuration. Monitor sub-agent activity for anomalies.

Useful 0 Not Useful 0