PT-2026-36855 · Evolve · Evolver

Xeloxa · Published 2026-04-22 · Updated 2026-05-04 · CVE-2026-42077

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3

Description A prototype pollution issue in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype. The flaw occurs within the applyUpdate() and updateRecord() functions, which utilize Object.assign() to merge user-controlled data without filtering dangerous keys such as proto, constructor, or prototype.

Recommendations Update to version 1.69.3.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-42077

GHSA-2CJR-5V3H-V2W4

Affected Products

Evolver

References · 8

• 🔥 https://github.com/EvoMap/evolver/security/advisories/GHSA-2cjr-5v3h-v2w4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42077 · Security Note
• https://osv.dev/vulnerability/GHSA-2cjr-5v3h-v2w4 · Vendor Advisory
• https://github.com/EvoMap/evolver · Note
• https://github.com/EvoMap/evolver/releases/tag/v1.69.3 · Note
• https://t.me/CVEtracker/52633 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051442053024788847 · Twitter Post
• https://twitter.com/CVEnew/status/2051361273380548738 · Twitter Post