---
title: "GHSA-vh95-rmgr-6w4m: Prototype Pollution in minimist"
description: "Moderate severity. Prototype Pollution in minimist. Affects minimist; fixed in 1.2.3."
url: https://inlinr.com/advisories/GHSA-vh95-rmgr-6w4m
lang: en
---

[Packages](https://inlinr.com/packages) / [minimist](https://inlinr.com/packages/minimist) / [Security](https://inlinr.com/packages/minimist/security)

Moderate Vulnerability GHSA-vh95-rmgr-6w4m CVE-2020-7598 Published 3 Apr 2020

# Prototype Pollution in minimist

Your version 

Affected releases · [minimist](https://inlinr.com/packages/minimist)

- 1.x 1.0.0 – 1.2.2 Fixed in 1.2.3
- 0.2.x 0.2.0 Fixed in 0.2.1
- 0.1.x and older 0.0.0 – 0.1.0 No fix, no longer updated

On 1.x, the newest line:

```
npm install minimist@1.2.3
```

Every release on a timeline

1.x 

1. Affected

1.0.0 – 1.2.2  
8 releases
2. Fixed

1.2.3 – 1.2.8  
6 releases, latest

0.x 

1. Affected

0.0.0 – 0.2.0  
13 releases
2. Fixed

0.2.1 – 0.2.4  
4 releases

31 stable releases of minimist, oldest to newest, one row per major.

## What happens

Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application.  
This is exploitable if attackers have control over the arguments being passed to `minimist`.

Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: low

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:L/​I:L/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-7598 "https://nvd.nist.gov/vuln/detail/CVE-2020-7598")  
nvd.nist.gov/vuln/detail/CVE-2020-7598
- [Fix commit](https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68 "https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68")  
10bd4cd
- [Fix commit](https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab "https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab")  
38a4d1c
- [Fix commit](https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95 "https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95")  
4cf1354
- [Fix commit](https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94 "https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94")  
63e7ed0
- [Package](https://github.com/substack/minimist "https://github.com/substack/minimist")  
github.com/substack/minimist
- [Reference](https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764")  
snyk.io/vuln/SNYK-JS-MINIMIST-559764
- [Reference](https://www.npmjs.com/advisories/1179 "https://www.npmjs.com/advisories/1179")  
npmjs.com/advisories/1179
- [Reference](http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html")  
lists.opensuse.org/opensuse-security-announce/2…