---
title: "GHSA-p9pc-299p-vxgp: yargs-parser Vulnerable to Prototype Pollution"
description: "Moderate severity. yargs-parser Vulnerable to Prototype Pollution. Affects yargs-parser; fixed in 18.1.1."
url: https://inlinr.com/advisories/GHSA-p9pc-299p-vxgp
lang: en
---

[Packages](https://inlinr.com/packages) / [yargs-parser](https://inlinr.com/packages/yargs-parser) / [Security](https://inlinr.com/packages/yargs-parser/security)

Moderate Vulnerability GHSA-p9pc-299p-vxgp CVE-2020-7608 SNYK-JS-YARGSPARSER-560381 Published 4 Sep 2020

# yargs-parser Vulnerable to Prototype Pollution

Your version 

Affected releases · [yargs-parser](https://inlinr.com/packages/yargs-parser)

- 18.x 18.0.0 – 18.1.0 Fixed in 18.1.1
- 17.x to 16.x 16.0.0 – 17.1.0 No fix, no longer updated
- 15.x 15.0.0 Fixed in 15.0.1
- 14.x 14.0.0 No fix on this line yet
- 13.x 13.0.0 – 13.1.1 Fixed in 13.1.2
- 12.x to 6.x 6.0.0 – 12.0.0 No fix, no longer updated
- 5.x 5.0.0 Fixed in 5.0.1
- 4.x and older 1.0.0 – 4.2.1 No fix, no longer updated

On 18.x, the newest line:

```
npm install yargs-parser@18.1.1
```

Every release on a timeline

22.x 

1. Not affected

22.0.0  
1 release, latest

18.x 

1. Affected

18.0.0 – 18.1.0  
2 releases
2. Fixed

18.1.1 – 18.1.3  
3 releases

17.x 

1. Affected

17.0.0 – 17.1.0  
3 releases

16.x 

1. Affected

16.0.0 – 16.1.0  
2 releases

15.x 

1. Affected

15.0.0  
1 release
2. Fixed

15.0.1 – 15.0.3  
3 releases

14.x 

1. Affected

14.0.0  
1 release

13.x 

1. Affected

13.0.0 – 13.1.1  
3 releases
2. Fixed

13.1.2  
1 release

12.x 

1. Affected

12.0.0  
1 release

11.x 

1. Affected

11.0.0 – 11.1.1  
3 releases

10.x 

1. Affected

10.0.0 – 10.1.0  
2 releases

9.x 

1. Affected

9.0.0 – 9.0.2  
3 releases

8.x 

1. Affected

8.0.0 – 8.1.0  
2 releases

7.x 

1. Affected

7.0.0  
1 release

6.x 

1. Affected

6.0.0 – 6.0.1  
2 releases

5.x 

1. Affected

5.0.0  
1 release
2. Fixed

5.0.1  
1 release

4.x 

1. Affected

4.0.0 – 4.2.1  
6 releases

3.x 

1. Affected

3.1.0 – 3.2.0  
2 releases

2.x 

1. Affected

2.0.0 – 2.4.1  
7 releases

1.x 

1. Affected

1.0.0 – 1.1.0  
2 releases

71 stable releases of yargs-parser, oldest to newest, one row per major.

## What happens

Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.

Recommendation

Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.

## How it is exploited

Exploitable with local access, with a low-privilege account and no action from a user.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: low

CVSS:3.1/​AV:L/​AC:L/​PR:L/​UI:N/​S:U/​C:L/​I:L/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-7608 "https://nvd.nist.gov/vuln/detail/CVE-2020-7608")  
nvd.nist.gov/vuln/detail/CVE-2020-7608
- [Fix commit](https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36 "https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36")  
1c417bd
- [Fix commit](https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2 "https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2")  
63810ca
- [Package](https://github.com/yargs/yargs-parser "https://github.com/yargs/yargs-parser")  
github.com/yargs/yargs-parser
- [Reference](https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381 "https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381")  
snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- [Reference](https://www.npmjs.com/advisories/1500 "https://www.npmjs.com/advisories/1500")  
npmjs.com/advisories/1500