What is GHSA-45q2-34rf-mr94?

GHSA-45q2-34rf-mr94 is a security advisory published by GitHub Security Advisories with Medium severity. Code Injection in mquery

Which CVE IDs does GHSA-45q2-34rf-mr94 cover?

GHSA-45q2-34rf-mr94 covers the following CVE IDs: CVE-2020-35149. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-45q2-34rf-mr94?

GHSA-45q2-34rf-mr94 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-45q2-34rf-mr94?

GHSA-45q2-34rf-mr94 affects 1 product, including: npm/mquery:\u003c 3.2.3.

GHSA-45q2-34rf-mr94MediumCVSS 5.3

Code Injection in mquery

Vendor

GitHub Security Advisories

Published

December 18, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-35149 →

📋 Description

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., proto) can be copied during a merge or clone operation.

🎯 Affected products1

npm/mquery:< 3.2.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-35149
https://github.com/aheckmann/mquery/commit/792e69fd0a7281a0300be5cade5a6d7c1d468ad4
https://github.com/advisories/GHSA-45q2-34rf-mr94