{"data":{"id":"df3052df-997c-4234-b9da-481480c6fce6","title":"CVE-2026-42077: Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution…","summary":"CVE-2026-42077 affects Evolver, a GEP-powered self-evolving engine for AI agents, before version 1.69.3. A prototype pollution flaw in the mailbox store module lets attackers inject malicious properties into Object.prototype, altering the behavior of all JavaScript objects. The flaw sits in the _applyUpdate() and _updateRecord() functions, which merge user-controlled data with Object.assign() without filtering keys such as __proto__, constructor, or prototype.","solution":"Fixed in 1.69.3.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42077","publishedAt":"2026-05-04T17:16:24.587Z","cveId":"CVE-2026-42077","cweIds":["CWE-1321"],"cvssScore":"5.2","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@evomap/evolver@< 1.69.3 (fixed: 1.69.3)"],"affectedPackageNames":["@evomap/evolver"],"affectedPackageRefs":["npm:@evomap/evolver"],"affectedVendors":[],"affectedVendorsRaw":["Evolver"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Evolver prototype pollution in mailbox store update functions","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","attackVector":"local","attackComplexity":"high","privilegesRequired":"high","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00157,"epssCheckedAt":"2026-11-09T06:13:51.964Z","kevDateAdded":null,"advisoryAliases":["GHSA-2cjr-5v3h-v2w4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:55.066Z","patchAvailable":true,"disclosureDate":"2026-05-04T17:16:24.587Z","fixReleasedAt":"2026-04-20T01:23:02.554Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:37:00.764Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@evomap/evolver","fixedVersion":"1.69.3","matchedVersion":"1.69.3","fixReleasedAt":"2026-04-20T01:23:02.554Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:37:00.607Z"}]}}