CVE-2020-7616

express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.

• CWE-1321

• https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120Exploit, Third Party Advisory
• https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120Exploit, Third Party Advisory

Published

Apr 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7610All versions of bson before 1.1.4 are vulnerable to Deserial…9.8
• CVE-2020-7611All versions of io.micronaut:micronaut-http-client before 1.…9.8
• CVE-2020-7612Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-7613clamscan through 1.2.0 is vulnerable to Command Injection. I…8.1
• CVE-2020-7614npm-programmatic through 0.0.12 is vulnerable to Command Inj…9.8
• CVE-2020-7615fsa through 0.5.1 is vulnerable to Command Injection. The fi…7.8
• CVE-2020-7617ini-parser through 0.0.2 is vulnerable to Prototype Pollutio…9.8
• CVE-2020-7618sds through 3.2.0 is vulnerable to Prototype Pollution.The l…5.3
• CVE-2020-7619get-git-data through 1.3.1 is vulnerable to Command Injectio…9.8
• CVE-2020-7620pomelo-monitor through 0.3.7 is vulnerable to Command Inject…9.8
• CVE-2020-7621strong-nginx-controller through 1.0.2 is vulnerable to Comma…9.8
• CVE-2020-7622This affects the package io.jooby:jooby-netty before 1.6.9, …9.8