CVE-2026-42077
MediumCVSS 5.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Evolver prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The _applyUpdate() and _updateRecord() functions use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype.
Risk Assessment
An attacker can inject malicious properties into Object.prototype, altering the behavior of all JavaScript objects in the application. This may lead to security bypass or code execution.
Recommendation
Update Evolver to version 1.69.3 or later. Until then, consider validating input reaching the mailbox store module.
Other vulnerabilities in Evolver
See all- CVE-2026-42076Critical
Evolver is an AI self-evolving engine that prior to version 1.69.3 had a command injection vulnerability in the _extractLLM() function. This allows attackers to execute arbitrary shell commands on the server due to improper handling of parameters.
- CVE-2026-42075High
Evolver is an AI engine that prior to version 1.69.3 had a path traversal vulnerability in the skill download command. Attackers could write files to arbitrary locations on the filesystem, posing a risk of overwriting critical system files.
Original NVD description (English source)
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS