Prototype pollution in querymen
Priority LOW 26CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-915.
Summary
querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Why it matters now
EPSS 0.01156 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed querymen: 2.1.4querymen (npm): 2.1.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | querymen | before 2.1.4 | 2.1.4 | Patch available | CNA |
| — | querymen (npm) | before 2.1.4 | 2.1.4 | Patch available | GHSA-2cf2-2383-h4jv |
- querymen Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available CNA
- querymen (npm) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-2cf2-2383-h4jv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:querymen_project:querymen:*:*:*:*:*:*:*:* | before 2.1.4 | Vulnerable | Querymen Project |
- cpe:2.3:a:querymen_project:querymen:*:*:*:*:*:*:*:* Versions before 2.1.4 Vulnerable ·Querymen Project
Remediation
- Fix · CNA querymen Fixed in 2.1.4
- Fix · GHSA-2cf2-2383-h4jv querymen (npm) Fixed in 2.1.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7600
- 2026-10-03 Alias added: GHSA-2cf2-2383-h4jv
References
More Querymen Project Querymen vulnerabilities
- TI-2022-09433 Prototype pollution in querymen CVSS 3.1HIGH 7.5
Sources
- CVE-2020-7600 · CVE Program
- CVE-2020-7600 · NVD
- FIRST EPSS
- GHSA-2cf2-2383-h4jv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences