EvoMap evolver up to 1.69.2 Mailbox Store _applyUpdate/_updateRecord prototype pollution

Summaryinfo

A vulnerability identified as problematic has been detected in EvoMap evolver up to 1.69.2. Affected is the function _applyUpdate/_updateRecord of the component Mailbox Store Module. Performing a manipulation results in prototype pollution. This vulnerability is identified as CVE-2026-42077. The attack is only possible with local access. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in EvoMap evolver up to 1.69.2. It has been classified as problematic. This affects the function _applyUpdate/_updateRecord of the component Mailbox Store Module. The manipulation with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-42077 since 04/23/2026. The exploitability is told to be difficult. An attack has to be approached locally. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 1.69.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• EvoMap

Name

• evolver

Version

• 1.69.0
• 1.69.1
• 1.69.2

Website

• Product: https://github.com/EvoMap/evolver/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion