CVE-2020-7608: yargs-parser Vulnerable to Prototype Pollution
Summary
CVE-2020-7608: yargs-parser Vulnerable to Prototype Pollution. Affects yargs-parser across 4 version ranges.
< 5.0.1
>= 6.0.0, < 13.1.2
>= 14.0.0, < 15.0.1
>= 16.0.0, < 18.1.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- node-yargs-parser · Debian:11
The same CVE-2020-7608 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yargs-parser package is an npm package used for parsing command-line arguments in Node.js applications. It provides a convenient way to parse and extract values from command-line arguments. However, versions of yargs-parser prior to 13.1.2, 15.0.1, and 18.1.1 are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in yargs-parser arises from improper sanitization of arguments, which allows an attacker to modify the prototype of the Object. By passing the argument --foo.__proto__.bar baz', an attacker can add or modify the bar property with the value baz on all objects. This can lead to unexpected behavior and potential security issues if the modified property is used in sensitive operations. It's important to note that this vulnerability can only be exploited if the attacker has control over the arguments passed to yargs-parser.
How To Fix
Latest published version: 22.0.0 as of 22 Oct 2026
npm install yargs-parser@22.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.0.15.0.1npm install yargs-parser@5.0.1 -
>= 6.0.0, < 13.1.213.1.2npm install yargs-parser@13.1.2 -
>= 14.0.0, < 15.0.115.0.1npm install yargs-parser@15.0.1 -
>= 16.0.0, < 18.1.118.1.1npm install yargs-parser@18.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of yargs-parser.
Conclusion
The yargs-parser package is vulnerable to prototype pollution, which can lead to unexpected behavior and potential security issues. It is crucial to upgrade to the fixed versions of yargs-parser to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yargs-parser →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues.
An attacker can exploit this vulnerability by passing a specially crafted argument to yargs-parser, allowing them to modify the prototype of the Object and add or modify properties on all objects.
The consequences of this vulnerability depend on how the modified property is used. It could lead to unexpected behavior, data corruption, or even security vulnerabilities if the modified property is used in sensitive operations.
No, only versions prior to 13.1.2, 15.0.1, and 18.1.1 are affected. It is recommended to upgrade to the fixed versions to mitigate the vulnerability.
Yes, upgrading to versions 13.1.2, 15.0.1, 18.1.1, or later of yargs-parser fixes this vulnerability by properly sanitizing arguments to prevent prototype pollution.
