VULNERABILITY INTELLIGENCE

CVE-2020-7600

CVSS score5.3 MEDIUM
EPSS probability1.16%
CISA KEVNot currently listed
Published2020-03-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Weakness classification

  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Primary references