GitHub Advisoryadvisory · npm

GHSA-p23c-p8w2-ww5v Prototype Pollution in querymen

MEDIUM Published 2022-06-18 Modified 2022-06-20 Official page ↗
Aliases
CVE-2022-25871
Ecosystem
npm
Packages
querymen
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1321
Reviewed
2022-06-20

Affected packages

• npm querymen: <= 2.1.4 (no fix yet)

Description

All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of CVE-2020-7600.

Related

Alias · CVE (1)

  • CVE-2022-25871 All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References