Design/Logic Flaw

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

UBUNTU-CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

CVE-2020-7608 affects the yargs-parser package and enables prototype pollution via a proto payload, allowing modification of Object.prototype. Public data notes local/remote impact depending on the environment, with CVSS vectors indicating low-to-medium base severity (NVD CVSS v3.1: 5.3, LOCAL, L...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

another-work-report-generator (>=3.4.1, <=3.4.5), largest-package (>=5.0.0, <=8.0.0) +5 more potentially affected by CVE-2020-7608 via yargs-parser (5.0.0-security.0)

yargs-parser NPM version 5.0.0-security.0 is affected by a known vulnerability. The following packages have a transitive dependency on yargs-parser and may be impacted: - another-work-report-generator =3.4.1, =5.0.0, =1.1.0, =0.1.0, =4.13.5, =0.7.25, =0.7.26 - yargs 7.1.1 Source cves: CVE-2020-76...

00.demo (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +39527 more potentially affected by CVE-2020-7608 via yargs-parser (>=6.0.1, <=13.1.1)

yargs-parser NPM version =6.0.1, =1.0.0, =1.0.0, =8.3.5, =0.1.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2020-7608 Source advisory: SNYK:JS-YARGSPARSER-560381...

@absolunet/ioc (2.0.0), @absolunet/nwayo-workflow (>=3.7.2, <=3.8.1) +884 more potentially affected by CVE-2020-7608 via yargs-parser (>=16.0.0, <=18.1.0)

yargs-parser NPM version =16.0.0, =3.7.2, =6.0.4, =1.0.0, =1.0.2, =1.0.6, =1.4.0-alpha.1, =1.19.6, =1.0.0, =5.0.0, =2.0.0-beta.2, =2.0.0-beta.2, =2.3.2 and more Source cves: CVE-2020-7608 Source advisory: SNYK:JS-YARGSPARSER-560381...

@alib/build-scripts (>=0.1.0-0, <=1.0.0-0), @alicd/cone-build-scripts (>=0.1.0, <=0.1.2) +220 more potentially affected by CVE-2020-7608 via yargs-parser (>=14.0.0, <=15.0.0)

yargs-parser NPM version =14.0.0, =0.1.0-0, =0.1.0, =0.1.1-1, =0.1.1-1, =0.1.1-1, =0.1.0, =0.3.1, =1.0.22-alpha.2, =1.3.0-alpha.1, =0.1.0-alpha.3, =0.1.7-alpha.1, =0.2.4-alpha.1, =0.3.4 and more Source cves: CVE-2020-7608 Source advisory: SNYK:JS-YARGSPARSER-560381...

Prototype Pollution

Overview yargs-parser is a mighty option parser used by yargs. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of Object.prototype using a proto payload. Our research team checked several attack vectors to...

CVE-2020-7608: Improperly Controlled Modification of Object Prototype Attributes

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...