description: querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
problem types: Prototype Pollution
affected:
{
product: querymen
vendor: n/a
versions:
status: affected, version: All versions prior to 2.1.4
}