MediumVulnerability
CVE-2026-42077: Evolver prototype pollution in mailbox store update functions
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-42077
- Published
- Record updated
- Affected
- @evomap/evolver < 1.69.3
- Fixed in
- 1.69.3
- released April 19, 2026, 14 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CVE-2026-42077 affects Evolver, a GEP-powered self-evolving engine for AI agents, before version 1.69.3. A prototype pollution flaw in the mailbox store module lets attackers inject malicious properties into Object.prototype, altering the behavior of all JavaScript objects. The flaw sits in the _applyUpdate() and _updateRecord() functions, which merge user-controlled data with Object.assign() without filtering keys such as __proto__, constructor, or prototype.
Mitigation
Fixed in 1.69.3.
Topics
Related items
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
- MediumOn the hunt for ARTEX: understanding agentic attacks in AWS environmentsSimilar attack · Datadog Security Labs
- CriticalCVE-2026-102895: GPUStack Improper Authentication VulnerabilitySimilar attack · CISA Known Exploited Vulnerabilities
- HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database