Prior to version 1.69.3, Evolver’s mailbox store module suffers from prototype pollution. The functions _applyUpdate() and _updateRecord() use Object.assign() to merge data supplied by the user without filtering dangerous prototype keys such as __proto__, constructor, or prototype. An attacker who can inject such keys alters the JavaScript Object prototype, causing all objects in the runtime to inherit malicious properties and potentially change program flow. This flaw is classified as CWE‑1321.

Systems running EvoMap’s Evolver engine before 1.69.3 are vulnerable. The update to version 1.69.3 includes the necessary patch. If an implementation remains on an older release, it should be upgraded at the earliest convenience.

The CVSS score of 5.2 indicates a moderate risk. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the probable attack vector involves an attacker sending crafted data to the mailbox store, such as through a connected interface or API. Because the flaw modifies global object behavior, successful exploitation may lead to arbitrary code execution or other unpredictable outcomes. Mitigation requires updating to a fixed version or applying the workaround until a patch is available.