GHSA-p23c-p8w2-ww5v

Prototype Pollution in querymen

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25871

Packages

Ecosystem	Package	Affected	Fixed in
npm	querymen	<= 2.1.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25871 advisory
https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488 web