GHSA-45q2-34rf-mr94

Code Injection in mquery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-35149

Packages

Ecosystem	Package	Affected	Fixed in
npm	mquery	< 3.2.3	3.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-35149 advisory
https://github.com/aheckmann/mquery/commit/792e69fd0a7281a0300be5cade5a6d7c1d468ad4 web