What’s Vulnerable › Vulnerabilities

CVE-2020-7600

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-03-12 · updated 2026-06-17
• Weakness: CWE-1321

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Affected products

• querymen: before 2.1.4 — fixed in 2.1.4

How to fix

Upgrade to a fixed version: querymen 2.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef
• https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867
• https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef
• https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867

Get alerted when CVE-2020-7600 or the next vulnerability affects your stack