Description
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects.
Recommendation
Update the yargs-parser package to the latest compatible version. Followings are version details:
Affected version(s): **>= 16.0.0, < 18.1.1 <= 5.0.0 >= 6.0.0, < 13.1.2 >= 14.0.0, < 15.0.1** Patched version(s): **18.1.1 5.0.1 13.1.2 15.0.1**
References
Could your website be exposed too?
SmartScanner can check your website for yargs-parser Vulnerable to Prototype Pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- dset vulnerable to prototype pollution - CVE-2020-28277
- shvl vulnerable to prototype pollution - CVE-2020-28278
- TypeORM vulnerable to MAID and Prototype Pollution - CVE-2020-8158
- datatables.net vulnerable to Prototype Pollution due to incomplete fix - CVE-2020-28458
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023