CVE-2020-7600

Published: Mar 12, 2020Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Affected (1)

Products: Querymen Project: Querymen

Querymen Project

1 product

Querymen

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Querymen Project Querymen	Before 2.1.4

Related CWEs

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (4)

https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.