CVE-2020-7598: Prototype Pollution in minimist
Summary
CVE-2020-7598: Prototype Pollution in minimist. Affects minimist across 2 version ranges.
< 0.2.1
>= 1.0.0, < 1.2.3
Fixed in 0.2.1 or 1.2.3, depending on the release line you run. How to fix ↓
Also tracked for
- node-minimist · Debian:11
The same CVE-2020-7598 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
minimist is an npm package that provides a lightweight argument parsing for command-line options. It is commonly used in Node.js applications to parse command-line arguments and convert them into a JavaScript object. The package is vulnerable to prototype pollution, which allows attackers to modify the prototype of the Object and add or modify properties that will exist on all objects.
Vulnerability Detail
The vulnerability in minimist arises from the improper sanitization of arguments. By passing certain arguments, an attacker can manipulate the prototype of the Object and introduce or modify properties that will affect all objects. For example, using the argument --__proto__.y=Polluted will add a property y with the value Polluted to all objects. Additionally, using the argument --__proto__=Polluted will raise an uncaught error and crash the application. This vulnerability can be exploited if the attacker has control over the arguments passed to the minimist function.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.2.10.2.1npm install minimist@0.2.1 -
>= 1.0.0, < 1.2.31.2.3npm install minimist@1.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The minimist package is vulnerable to prototype pollution, which can be exploited by passing specially crafted arguments. To mitigate this vulnerability, it is recommended to upgrade to minimist versions 0.2.1, 1.2.3, or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for minimist →
FAQ
minimist is an npm package used for parsing command-line arguments in Node.js applications.
Prototype pollution is a vulnerability that allows attackers to modify the prototype of an object and introduce or modify properties that will exist on all objects.
An attacker can exploit this vulnerability by passing specially crafted arguments to the minimist function, allowing them to modify the prototype of the Object and introduce or modify properties that will affect all objects.
No, only versions prior to 0.2.1 and 1.2.3 are affected. Upgrading to these versions or later will fix the vulnerability.
Yes, the CVSS score for this vulnerability is 5.6.
References
Related vulnerabilities
Recent vulnerabilities recorded for minimist.
