MEDIUM5.3
GHSA-2cf2-2383-h4jv
Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen
Quick fix
GHSA-2cf2-2383-h4jv — querymen: upgrade to the fixed version with the command below.
npm install querymen@2.1.4Details
querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Are you affected?
Enter the version of the package you're using.