CVE-2026-42077

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The vulnerability exists in the _applyUpdate() and _updateRecord() functions which use Object.assign() to merge user-controlled data without filtering dangerous keys like __proto__, constructor, or prototype. This issue has been patched in version 1.69.3.

• CWE-1321

• https://github.com/EvoMap/evolver/releases/tag/v1.69.3
• https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4
• https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4

Published

May 4, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42071Mantis Bug Tracker (MantisBT) is an open source issue tracke…7.2
• CVE-2026-42072Nornicdb is a distributed low-latency, Graph+Vector, Tempora…9.8
• CVE-2026-42073OpenClaude is an open-source coding-agent command line inter…6.5
• CVE-2026-42074OpenClaude is an open-source coding-agent command line inter…9.8
• CVE-2026-42075Evolver is a GEP-powered self-evolving engine for AI agents.…8.1
• CVE-2026-42076Evolver is a GEP-powered self-evolving engine for AI agents.…9.8
• CVE-2026-42078PPTAgent is an agentic framework for reflective PowerPoint g…4.6
• CVE-2026-42079PPTAgent is an agentic framework for reflective PowerPoint g…8.6
• CVE-2026-4208The extension fails to properly reset the generated MFA code…8.8
• CVE-2026-42080PPTAgent is an agentic framework for reflective PowerPoint g…4.6
• CVE-2026-42081free5GC is an open-source implementation of the 5G core netw…7.1
• CVE-2026-42082free5GC is an open-source implementation of the 5G core netw…5.4