Skip to content
OpenAdvisories

Package · npm

@evomap/evolver

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.2
    GHSA-7xp7-m392-h92c

    @evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS

    ## Summary The EvoMap proxy daemon's HTTP body parser accepts requests of any size, and the `POST /asset/submit` route persists the full request body — verbatim and uncapped — as a JSONL line in `<dataDir>/messages.jsonl`. An unauthenticated local attacker (o…

    @evomap/evolver npm
  • Medium 5.2
    CVE-2026-42077

    Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations

    Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Obje…

    EvoMap evolver @evomap/evolver npm