{"api_version":"1","generated_at":"2026-07-23T13:09:37+00:00","cve":"CVE-2020-7600","urls":{"html":"https://cve.report/CVE-2020-7600","api":"https://cve.report/api/cve/CVE-2020-7600.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-7600","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7600"},"summary":{"title":"CVE-2020-7600","description":"querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.","state":"PUBLIC","assigner":"report@snyk.io","published_at":"2020-03-12 23:15:00","updated_at":"2022-12-02 19:58:00"},"problem_types":["CWE-1321"],"metrics":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867","name":"https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Prototype Pollution in querymen | Snyk","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef","name":"https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Fix prototype pollution vulnerability (#77) · diegohaz/querymen@1987fef · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7600","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7600","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"7600","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"querymen_project","cpe5":"querymen","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7600","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"querymen_project","cpe5":"querymen","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-7600","qid":"981934","title":"Nodejs (npm) Security Update for querymen (GHSA-2cf2-2383-h4jv)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-7600","ASSIGNER":"report@snyk.io","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"querymen","version":{"version_data":[{"version_value":"All versions prior to 2.1.4"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Prototype Pollution"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef","url":"https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef"},{"refsource":"MISC","name":"https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867","url":"https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867"}]},"description":{"description_data":[{"lang":"eng","value":"querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks."}]}},"nvd":{"publishedDate":"2020-03-12 23:15:00","lastModifiedDate":"2022-12-02 19:58:00","problem_types":["CWE-1321"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:querymen_project:querymen:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"7600","Ordinal":"167881","Title":"CVE-2020-7600","CVE":"CVE-2020-7600","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"7600","Ordinal":"1","NoteData":"querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"7600","Ordinal":"2","NoteData":"2020-03-12","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"7600","Ordinal":"3","NoteData":"2020-03-12","Type":"Other","Title":"Modified"}]}}}