CVE-2026-77930: EvoScientist Auth Bypass Vulnerability

CVE-2026-77930 Overview

CVE-2026-77930 is a human-in-the-loop (HITL) approval bypass in EvoScientist versions 0.1.0 through 0.2.4. The agent framework delegates shell command execution to asynchronous sub-agents created by start_async_task, which lack the interrupt_on approval gate enforced on synchronous flows. An attacker who plants instructions inside ingested content, such as a fetched web page, can trigger the async path and run arbitrary host shell commands with the running user's privileges and environment secrets. The weakness is tracked as missing authorization [CWE-862] and was fixed in release v0.2.5 by unifying HITL approval across sync and async sub-agents.

Critical Impact

Prompt-injected content can execute arbitrary host shell commands under the EvoScientist user account, exposing environment secrets and enabling full host compromise.

Affected Products

• EvoScientist 0.1.0 and later releases prior to 0.2.5
• Deployments exposing async sub-agent execution via start_async_task
• Environments where EvoScientist ingests untrusted external content such as fetched web pages

Discovery Timeline

• 2026-10-20 - CVE-2026-77930 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-77930

Vulnerability Analysis

EvoScientist enforces human approval on sensitive tool calls using an interrupt_on gate that pauses execution and requests operator confirmation. The gate is applied to synchronous sub-agents but is not applied to the asynchronous execution path spawned through start_async_task. When the main agent delegates work to an async sub-agent, shell tools execute without the HITL checkpoint and without evaluation against the shell_allow_list.

The practical consequence is that any content the agent ingests can direct it to spawn an async sub-task that runs host commands. Because the sub-agent inherits the parent process context, commands run with the user's privileges, access to the local filesystem, and visibility of environment variables, including API keys and other secrets.

Root Cause

The root cause is missing authorization [CWE-862] in the async sub-agent factory at EvoScientist/subagents/_factory.py. Approval checks were coupled to the synchronous channel consumer rather than the shared backend that resolves action decisions. As a result, config rules such as auto_approve, HITL_ALWAYS_PROMPT_TOOLS, and shell_allow_list were not consulted for async-delegated shell commands.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction. An attacker hosts prompt-injection payloads in content the agent will fetch, such as a web page, document, or feed. When the agent processes that content, it is instructed to invoke start_async_task with a shell command. The async sub-agent executes the command directly, bypassing operator approval.

# Patch excerpt: EvoScientist/channels/consumer.py
# Unified HITL approval for sync + async sub-agents (closes #387)
if outcome.decisions is None:
    return None  # reject / timeout / stop — end the turn

from ..backends import build_hitl_resume

stream_input = build_hitl_resume(
    interrupt_data.get("interrupt_id"), outcome.decisions
)
# continue to next HITL round

Source: GitHub Commit d249e320

Detection Methods for CVE-2026-77930

Indicators of Compromise

• Unexpected child processes spawned by the EvoScientist Python interpreter, especially /bin/sh, bash, curl, wget, or package managers.
• Outbound network connections from the EvoScientist host to attacker-controlled infrastructure immediately after content ingestion events.
• Agent logs showing start_async_task invocations that execute shell tools without a corresponding HITL approval record.
• Access to environment files or credential stores (~/.aws/credentials, .env, SSH keys) by processes descended from the agent runtime.

Detection Strategies

• Correlate agent audit logs for start_async_task entries against HITL approval events and flag any async shell execution without an approval ID.
• Baseline the EvoScientist process tree and alert on new child executables, interactive shells, or scripting interpreters launched from the agent process.
• Inspect ingested content for prompt-injection patterns referencing start_async_task, shell, or tool-call directives.

Monitoring Recommendations

• Forward EvoScientist application logs and host process telemetry to a centralized analytics platform for correlation and retention.
• Monitor egress traffic from agent hosts for anomalous destinations, DNS exfiltration patterns, and large outbound transfers.
• Alert on reads of secret files and environment variable dumps performed by any process descended from the agent runtime.

How to Mitigate CVE-2026-77930

Immediate Actions Required

• Upgrade EvoScientist to release v0.2.5 or later, which applies unified HITL approval to synchronous and asynchronous sub-agents.
• Rotate any API keys, tokens, and credentials present in the agent host's environment or configuration if the agent processed untrusted content before patching.
• Restrict the EvoScientist runtime to a dedicated, least-privilege user account with no access to production credentials or sensitive filesystem paths.
• Audit recent agent logs for start_async_task invocations that executed shell commands without an approval record.

Patch Information

The fix is included in EvoScientist release v0.2.5 and tracked in GitHub Issue #387. The commit d249e320 routes async sub-agent decisions through build_hitl_resume and resolve_action_decision, so the auto_approve flag, HITL_ALWAYS_PROMPT_TOOLS, and shell_allow_list apply uniformly. Additional details are available in the VulnCheck advisory for EvoScientist and the Lasso Security entry for CVE-2026-77930.

Workarounds

• Disable or remove shell execution tools from async sub-agent factories until the patched release can be deployed.
• Run EvoScientist inside a container or sandbox with no shell, read-only filesystem, and no access to host secrets or network paths beyond required endpoints.
• Strip or sanitize ingested external content for tool-call directives before passing it to the agent context.
• Set auto_approve to false and configure a strict shell_allow_list so any shell invocation must satisfy policy, even once the patch is applied.

# Upgrade EvoScientist to the patched release
pip install --upgrade "EvoScientist>=0.2.5"

# Verify installed version
python -c "import EvoScientist; print(EvoScientist.__version__)"