CVE-2026-42077

{
  "id": "CVE-2026-42077",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T17:16:24.587",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3."
    },
    {
      "lang": "es",
      "value": "Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versión 1.69.3, una vulnerabilidad de contaminación de prototipos en el módulo de almacenamiento de buzones permite a los atacantes modificar el comportamiento de todos los objetos JavaScript inyectando propiedades maliciosas en Object.prototype. La vulnerabilidad existe en las funciones _applyUpdate() y _updateRecord() que utilizan Object.assign() para fusionar datos controlados por el usuario sin filtrar claves peligrosas como __proto__, constructor o prototype. Este problema ha sido parcheado en la versión 1.69.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "EvoMap",
          "product": "evolver",
          "versions": [
            {
              "version": "< 1.69.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T13:40:45.787015Z",
          "id": "CVE-2026-42077",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}