CVE-2026-42077

Katalog CVE

CVSS 5.2 · Medium EPSS 0,28%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Skor CVSS 3.1 5.2 (Medium) menurut github.com.

Deskripsi (NVD)

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.

Rincian

Terbit di NVD

4 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

5.2 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/EvoMap/evolver/releases/tag/v1.69.3
• https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4