Packages / yargs-parser / Security

ModerateVulnerabilityGHSA-p9pc-299p-vxgpCVE-2020-7608SNYK-JS-YARGSPARSER-560381Published 4 Sep 2020

yargs-parser Vulnerable to Prototype Pollution

Your version

Affected releases · yargs-parser

  • 18.x18.0.0 – 18.1.0Fixed in 18.1.1
  • 17.x to 16.x16.0.0 – 17.1.0No fix, no longer updated
  • 15.x15.0.0Fixed in 15.0.1
  • 14.x14.0.0No fix on this line yet
  • 13.x13.0.0 – 13.1.1Fixed in 13.1.2
  • 12.x to 6.x6.0.0 – 12.0.0No fix, no longer updated
  • 5.x5.0.0Fixed in 5.0.1
  • 4.x and older1.0.0 – 4.2.1No fix, no longer updated

On 18.x, the newest line:

npm install yargs-parser@18.1.1
Every release on a timeline
22.x

  1. Not affected

    22.0.0

    1 release, latest

18.x

  1. Affected

    18.0.0 – 18.1.0

    2 releases

  2. Fixed

    18.1.1 – 18.1.3

    3 releases

17.x

  1. Affected

    17.0.0 – 17.1.0

    3 releases

16.x

  1. Affected

    16.0.0 – 16.1.0

    2 releases

15.x

  1. Affected

    15.0.0

    1 release

  2. Fixed

    15.0.1 – 15.0.3

    3 releases

14.x

  1. Affected

    14.0.0

    1 release

13.x

  1. Affected

    13.0.0 – 13.1.1

    3 releases

  2. Fixed

    13.1.2

    1 release

12.x

  1. Affected

    12.0.0

    1 release

11.x

  1. Affected

    11.0.0 – 11.1.1

    3 releases

10.x

  1. Affected

    10.0.0 – 10.1.0

    2 releases

9.x

  1. Affected

    9.0.0 – 9.0.2

    3 releases

8.x

  1. Affected

    8.0.0 – 8.1.0

    2 releases

7.x

  1. Affected

    7.0.0

    1 release

6.x

  1. Affected

    6.0.0 – 6.0.1

    2 releases

5.x

  1. Affected

    5.0.0

    1 release

  2. Fixed

    5.0.1

    1 release

4.x

  1. Affected

    4.0.0 – 4.2.1

    6 releases

3.x

  1. Affected

    3.1.0 – 3.2.0

    2 releases

2.x

  1. Affected

    2.0.0 – 2.4.1

    7 releases

1.x

  1. Affected

    1.0.0 – 1.1.0

    2 releases

71 stable releases of yargs-parser, oldest to newest, one row per major.

What happens

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.

Recommendation

Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.