Description (CNA)
querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / querymen | affected All versions prior to 2.1.4 |
CWE
No CWE identifiers supplied.
References
- https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef
- https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867
ADP enrichment
No English description supplied.