medium5.3
CVE-2020-7608
yargs-parser Vulnerable to Prototype Pollution
Impact
Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`. ## Recommendation Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | yargs-parser | >= 6.0.0, < 13.1.2 | 13.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yargs | Yargs-Parser | before 5.0.1 from 6.0.0 before 13.1.2 from 14.0.0 before 15.0.1 from 16.0.0 before 18.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://github.com/advisories/GHSA-p9pc-299p-vxgp
- https://www.npmjs.com/advisories/1500
- https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2
- https://nvd.nist.gov/vuln/detail/CVE-2020-7608
- https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36