EvoMap evolver versions before 1.69.3 contain a prototype pollution vulnerability (CWE-1321) in the mailbox store module. The vulnerability arises because the functions _applyUpdate() and _updateRecord() merge user-supplied data into objects using Object.assign() without filtering out keys that can alter the Object prototype, such as __proto__, constructor, or prototype. This flaw enables attackers with high privileges to inject properties into Object.prototype, potentially modifying the behavior of all JavaScript objects in the environment. The issue has been fixed in version 1.69.3.

An attacker with high privileges can exploit this vulnerability to perform prototype pollution by injecting malicious properties into Object.prototype. This can lead to altered behavior of JavaScript objects, potentially causing integrity and availability impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: High). No known exploits in the wild have been reported.

This vulnerability has been patched in EvoMap evolver version 1.69.3. Users should upgrade to version 1.69.3 or later to remediate this issue. Since the product is not a cloud service, remediation depends on applying the vendor's patch. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix is included in version 1.69.3.