CVE-2020-7600: querymen - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Summary
CVE-2020-7600: Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen. Affects querymen versions < 2.1.4. Fixed in 2.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
querymen is an npm package that provides a query builder for MongoDB. It allows users to construct complex queries using a simple and intuitive API. However, prior to version 2.1.4, querymen is vulnerable to an improper modification of object properties, which can be abused for Prototype Pollution attacks.
Vulnerability Detail
The vulnerability in querymen arises from the lack of sanitization of the parameters in the exported function handler(type, name, fn). This allows users to control these parameters without any validation, leading to potential Prototype Pollution attacks. An attacker could manipulate the object properties and introduce malicious code, potentially leading to unauthorized access, data manipulation, or denial of service.
How To Fix
Latest published version: 2.1.4 as of 22 Oct 2026
npm install querymen@2.1.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of querymen to mitigate the risk.
Conclusion
The vulnerability in querymen allows for the improper modification of object properties, which can be exploited for Prototype Pollution attacks. It is crucial to update to querymen version 2.1.4 or later to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for querymen →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or security issues.
An attacker can exploit this vulnerability by manipulating the object properties passed to the querymen handler function, introducing malicious code and potentially compromising the application.
There are no known public exploits for this vulnerability at the moment.
No, only versions prior to 2.1.4 are affected. It is recommended to upgrade to the latest version to ensure the vulnerability is patched.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for querymen.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
