Prototype Pollution Vulnerability in Evolver by GEP
CVE-2026-42077

5.2MEDIUM

Key Information:

Vendor

Evomap

Status
Evolver
Vendor
CVE Published:
4 May 2026

What is CVE-2026-42077?

The Evolver engine, developed by GEP, contains a prototype pollution weakness in its mailbox store module. This flaw allows attackers to manipulate JavaScript objects by injecting harmful properties into the Object.prototype during data merging operations. Specifically, the vulnerabilities are found in the _applyUpdate() and _updateRecord() functions, which leverage Object.assign() in a manner that fails to sanitize crucial keys. As a result, malicious users can alter the expected behavior of all JavaScript objects, leading to potentially severe security issues. This vulnerability has been effectively resolved in version 1.69.3.

Affected Version(s)

evolver < 1.69.3

References

https://github.com/EvoMap/evolver/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/EvoMap/evolver/releases/tag/v1.69.3
x_refsource_MISC

CVSS V3.1

Score:
5.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.