EvoMap evolver versions before 1.69.3 contain a prototype pollution vulnerability (CWE-1321) in the mailbox store module. The vulnerability arises because the _applyUpdate() and _updateRecord() functions use Object.assign() to merge user-controlled input without filtering out prototype-related keys such as __proto__, constructor, or prototype. This improper handling enables attackers with high privileges to inject properties into Object.prototype, potentially altering the behavior of all JavaScript objects in the environment. The issue has been addressed by the vendor in version 1.69.3.

An attacker with high privileges on a vulnerable EvoMap evolver instance can exploit this vulnerability to modify the prototype of JavaScript objects, potentially leading to altered application behavior and high impact on availability. The confidentiality and integrity impacts are low, but the availability impact is high as per the CVSS vector. No known exploits in the wild have been reported.

Upgrade EvoMap evolver to version 1.69.3 or later, where this prototype pollution vulnerability has been patched. Since this is not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor's versioning information. No additional mitigation steps are indicated.