Search for packages
| purl | pkg:npm/minimist@1.2.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bhnm-47u8-zfhr
Aliases: CVE-2020-7598 GHSA-vh95-rmgr-6w4m |
Prototype Pollution in minimist Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later. |
Affected by 1 other vulnerability. |
|
VCID-turp-dju7-c7fx
Aliases: CVE-2021-44906 GHSA-xvch-5gv4-984h |
Prototype Pollution in minimist Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4t4e-47cq-2ffx | Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution) **Withdrawn** GitHub has withdrawn this advisory in place of GHSA-vh95-rmgr-6w4m and GHSA-6chw-6frg-f759. The reason for withdrawing is that some mistakes were made during the ingestion of CVE-2020-7598 which caused this advisory to be published with incorrect information. In order to provide accurate advisory information, new advisories were created: - minimist: https://github.com/advisories/GHSA-vh95-rmgr-6w4m - acorn: https://github.com/advisories/GHSA-6chw-6frg-f759 |
GHSA-7fhm-mqm4-2wp7
|
| VCID-bhnm-47u8-zfhr | Prototype Pollution in minimist Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later. |
CVE-2020-7598
GHSA-vh95-rmgr-6w4m |