Medium severity5.3NVD Advisory· Published Mar 12, 2020· Updated Jun 17, 2026

CVE-2020-7600

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
querymennpm	< 2.1.4	2.1.4

Affected products

Querymen Project/Querymen
cpe:2.3:a:querymen_project:querymen:*:*:*:*:*:*:*:*
Range: <2.1.4
querymen/querymendescription
ghsa-coords
pkg:npm/querymen
Range: < 2.1.4

Patches

Vulnerability mechanics

References

snyk.io/vuln/SNYK-JS-QUERYMEN-559867nvdPatchThird Party AdvisoryWEB
github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cefnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-2cf2-2383-h4jvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-7600ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000