yargs-parser Vulnerable to Prototype Pollution

🗓️ 04 Sep 2020 18:00:54Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 247 Views

yargs-parser Vulnerable to Prototype Pollution. Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later

Reporter	Title	Published	Views	Family All 84
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	17 Aug 202209:46	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains security vulnerabilities	13 May 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11, v12 & IBM Integration Bus (CVE-2020-7608)	27 Jun 202217:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.15.0 shipped with IBM Cloud Pak for Business Automation iFixes for December 2025.	7 Jan 202612:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities	12 Jan 202120:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: OSS scan fixes for Content pos	15 Dec 202006:58	–	ibm
ATTACKERKB	CVE-2020-7608	16 Mar 202020:15	–	attackerkb

Vulners

Node

yargs yargs-parserRange16.0.0–18.1.1npm

yargs yargs-parserRange6.0.0–13.1.2npm

yargs yargs-parserRange14.0.0–15.0.1npm

Source	Link
snyk	www.snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
npmjs	www.npmjs.com/advisories/1500
github	www.github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-7608
github	www.github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36
github	www.github.com/advisories/GHSA-p9pc-299p-vxgp

27 Jan 2023 05:00Current

4.7Medium risk

Vulners AI Score4.7

CVSS 24.6

CVSS 3.15.3

EPSS0.00514