CVE-2026-42077

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/EvoMap/evolver/releases/tag/v1.69.3
https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4
https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versión 1.69.3, una vulnerabilidad de contaminación de prototipos en el módulo de almacenamiento de buzones permite a los atacantes modificar el comportamiento de todos los objetos JavaScript inyectando propiedades maliciosas en Object.prototype. La vulnerabilidad existe en las funciones _applyUpdate() y _updateRecord() que utilizan Object.assign() para fusionar datos controlados por el usuario sin filtrar claves peligrosas como __proto__, constructor o prototype. Este problema ha sido parcheado en la versión 1.69.3.

Information

Published : 2026-05-04 17:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-42077

Mitre link : CVE-2026-42077

CVE.ORG link : CVE-2026-42077

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-42077", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42077", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T13:40:45.787015Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 0.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"status": "affected", "version": "< 1.69.3"}]}]}], "published": "2026-05-04T17:16:24.587", "references": [{"url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "source": "security-advisories@github.com"}, {"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3."}, {"lang": "es", "value": "Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versi\u00f3n 1.69.3, una vulnerabilidad de contaminaci\u00f3n de prototipos en el m\u00f3dulo de almacenamiento de buzones permite a los atacantes modificar el comportamiento de todos los objetos JavaScript inyectando propiedades maliciosas en Object.prototype. La vulnerabilidad existe en las funciones _applyUpdate() y _updateRecord() que utilizan Object.assign() para fusionar datos controlados por el usuario sin filtrar claves peligrosas como __proto__, constructor o prototype. Este problema ha sido parcheado en la versi\u00f3n 1.69.3."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "security-advisories@github.com"}