{"id":"EUVD-2026-27012","enisaUuid":"67a4726d-361d-39db-9b11-0fe17d1e2047","description":"Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.","datePublished":"May 4, 2026, 4:50:15 PM","dateUpdated":"May 6, 2026, 1:40:54 PM","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","references":"https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4\nhttps://github.com/EvoMap/evolver/releases/tag/v1.69.3\n","aliases":"CVE-2026-42077\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"2ea461f9-2e25-3dc3-b651-fe628f7d3470","product":{"name":"evolver","vendor":{"name":"EvoMap"}},"product_version":"\u003c 1.69.3"}],"enisaIdVendor":[{"id":"3c56bd6f-026c-36f2-9bd1-6b7e3ff53aad","vendor":{"name":"EvoMap"}}],"enisaIdVulnerability":[{"id":"c4b77e49-59a9-390c-9fbb-31429d4ea288","vulnerability":{"id":"CVE-2026-42077","description":"Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.","datePublished":"May 4, 2026, 4:50:15 PM","dateUpdated":"May 6, 2026, 1:40:54 PM","status":"PUBLISHED","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","references":"https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4\nhttps://github.com/EvoMap/evolver/releases/tag/v1.69.3\n","enisa_id":"EUVD-2026-27012\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Nov 3, 2026, 7:17:08 AM","vulnerabilityProduct":[{"id":"5720e312-88e7-3595-a589-51dfb8889a96","product":{"name":"evolver","vendor":{"name":"EvoMap"}},"product_version":"\u003c 1.69.3"}],"vulnerabilityVendor":[{"id":"65e6ca93-fa8f-3796-a181-0c088d21bed5","vendor":{"name":"EvoMap"}}]}}],"enisaIdAdvisory":[]}