CVE-2020-7600

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
n/a	querymen	All versions prior to 2.1.4

References

https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cefExploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867Patch, Third Party Advisory
https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cefExploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867Patch, Third Party Advisory

Timeline

Published: Mar 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-76019.8gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function loca CVE-2020-76029.8node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linu CVE-2020-76039.8closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" CVE-2020-76049.8pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attack CVE-2020-76059.8gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options.CVE-2020-76069.8docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(service CVE-2020-76079.8gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be co CVE-2020-76085.3yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.CVE-2020-76099.8node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be con CVE-2020-76109.8All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an objec CVE-2020-76119.8All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Hea CVE-2020-76138.1clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` fu