---
title: "GHSA-xvch-5gv4-984h: Prototype Pollution in minimist"
description: "Critical severity. Prototype Pollution in minimist. Affects minimist; fixed in 1.2.6."
url: https://inlinr.com/advisories/GHSA-xvch-5gv4-984h
lang: en
---

[Packages](https://inlinr.com/packages) / [minimist](https://inlinr.com/packages/minimist) / [Security](https://inlinr.com/packages/minimist/security)

Critical Vulnerability GHSA-xvch-5gv4-984h CVE-2021-44906 Published 18 Mar 2022

# Prototype Pollution in minimist

Your version 

Affected releases · [minimist](https://inlinr.com/packages/minimist)

- 1.x 1.0.0 – 1.2.5 Fixed in 1.2.6
- 0.2.x 0.2.0 – 0.2.3 Fixed in 0.2.4
- 0.1.x and older 0.0.0 – 0.1.0 No fix, no longer updated

On 1.x, the newest line:

```
npm install minimist@1.2.6
```

Every release on a timeline

1.x 

1. Affected

1.0.0 – 1.2.5  
11 releases
2. Fixed

1.2.6 – 1.2.8  
3 releases, latest

0.x 

1. Affected

0.0.0 – 0.2.3  
16 releases
2. Fixed

0.2.4  
1 release

31 stable releases of minimist, oldest to newest, one row per major.

## What happens

Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file `index.js`, function `setKey()` (lines 69-95).

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: high
- **Integrity**: high
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:H/​I:H/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-44906 "https://nvd.nist.gov/vuln/detail/CVE-2021-44906")  
nvd.nist.gov/vuln/detail/CVE-2021-44906
- [Issue](https://github.com/minimistjs/minimist/issues/11 "https://github.com/minimistjs/minimist/issues/11")  
#11
- [Issue](https://github.com/substack/minimist/issues/164 "https://github.com/substack/minimist/issues/164")  
#164
- [Pull request](https://github.com/minimistjs/minimist/pull/24 "https://github.com/minimistjs/minimist/pull/24")  
#24
- [Fix commit](https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703 "https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703")  
34e20b8
- [Fix commit](https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb "https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb")  
bc8ecee
- [Fix commit](https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d "https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d")  
c2b9819
- [Fix commit](https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11 "https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11")  
ef9153f
- [Reference](https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip "https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip")  
github.com/Marynk/JavaScript-vulnerability-dete…
- [Reference](https://github.com/minimistjs/minimist/commits/v0.2.4 "https://github.com/minimistjs/minimist/commits/v0.2.4")  
github.com/minimistjs/minimist/commits/v0.2.4
- [Package](https://github.com/substack/minimist "https://github.com/substack/minimist")  
github.com/substack/minimist
- [Reference](https://github.com/substack/minimist/blob/master/index.js#L69 "https://github.com/substack/minimist/blob/master/index.js#L69")  
github.com/substack/minimist/blob/master/index.…
- [Reference](https://security.netapp.com/advisory/ntap-20240621-0006 "https://security.netapp.com/advisory/ntap-20240621-0006")  
security.netapp.com/advisory/ntap-20240621-0006
- [Reference](https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764")  
snyk.io/vuln/SNYK-JS-MINIMIST-559764
- [Reference](https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068 "https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068")  
stackoverflow.com/questions/8588563/adding-cust…