CVE-2026-42077

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42077", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-23T19:17:30.565Z", "datePublished": "2026-05-04T16:50:15.167Z", "dateUpdated": "2026-05-06T13:40:54.808Z"}, "containers": {"cna": {"title": "Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4"}, {"name": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"}], "affected": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"version": "< 1.69.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T16:50:15.167Z"}, "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3."}], "source": {"advisory": "GHSA-2cjr-5v3h-v2w4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T13:40:45.787015Z", "id": "CVE-2026-42077", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:40:54.808Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42077", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T13:40:45.787015Z"}}}], "references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:38:42.448Z"}}], "cna": {"title": "Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations", "source": {"advisory": "GHSA-2cjr-5v3h-v2w4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"status": "affected", "version": "< 1.69.3"}]}], "references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "name": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "name": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T16:50:15.167Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42077", "state": "PUBLISHED", "dateUpdated": "2026-05-06T13:40:54.808Z", "dateReserved": "2026-04-23T19:17:30.565Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T16:50:15.167Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "evolver", "vendor": "EvoMap", "versions": [{"status": "affected", "version": "< 1.69.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3."}, {"lang": "es", "value": "Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versi\u00f3n 1.69.3, una vulnerabilidad de contaminaci\u00f3n de prototipos en el m\u00f3dulo de almacenamiento de buzones permite a los atacantes modificar el comportamiento de todos los objetos JavaScript inyectando propiedades maliciosas en Object.prototype. La vulnerabilidad existe en las funciones _applyUpdate() y _updateRecord() que utilizan Object.assign() para fusionar datos controlados por el usuario sin filtrar claves peligrosas como __proto__, constructor o prototype. Este problema ha sido parcheado en la versi\u00f3n 1.69.3."}], "id": "CVE-2026-42077", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42077", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T13:40:45.787015Z", "version": "2.0.3"}}]}, "published": "2026-05-04T17:16:24.587", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.69.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "evolver", "source": "cna", "vendor": "EvoMap"}, "product": "evolver", "vendor": "evomap"}], "created": "2026-05-04T18:45:06.427515+00:00", "updated": "2026-05-06T09:22:45.157066+00:00", "vendors": ["evomap", "evomap$PRODUCT$evolver"]}