nodejs-yargs-parser: prototype pollution vulnerability

A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a "proto" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

nodejs-yargs-parser: prototype pollution vulnerability

A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a "proto" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

GHSA-P9PC-299P-VXGP yargs-parser Vulnerable to Prototype Pollution

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --foo.proto.bar...

@alib/build-scripts (>=0.1.0-0, <=1.0.0-0), @alicd/cone-build-scripts (>=0.1.0, <=0.1.2) +220 more potentially affected by CVE-2020-7608 via yargs-parser (>=14.0.0, <=15.0.0)

yargs-parser NPM version =14.0.0, =0.1.0-0, =0.1.0, =0.1.1-1, =0.1.1-1, =0.1.1-1, =0.1.0, =0.3.1, =1.0.22-alpha.2, =1.3.0-alpha.1, =0.1.0-alpha.3, =0.1.7-alpha.1, =0.2.4-alpha.1, =0.3.4 and more Source cves: CVE-2020-7608 Source advisory: OSV:GHSA-P9PC-299P-VXGP...

00.demo (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +39560 more potentially affected by CVE-2020-7608 via yargs-parser (>=6.0.1, <=13.1.1)

yargs-parser NPM version =6.0.1, =1.0.0, =1.0.0, =8.3.5, =0.1.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2020-7608 Source advisory: OSV:GHSA-P9PC-299P-VXGP...

another-work-report-generator (>=3.4.1, <=3.4.5), largest-package (>=5.0.0, <=8.0.0) +5 more potentially affected by CVE-2020-7608 via yargs-parser (5.0.0-security.0)

yargs-parser NPM version 5.0.0-security.0 is affected by a known vulnerability. The following packages have a transitive dependency on yargs-parser and may be impacted: - another-work-report-generator =3.4.1, =5.0.0, =1.1.0, =0.1.0, =4.13.5, =0.7.25, =0.7.26 - yargs 7.1.1 Source cves: CVE-2020-76...

@absolunet/ioc (2.0.0), @absolunet/nwayo-workflow (>=3.7.2, <=3.8.1) +885 more potentially affected by CVE-2020-7608 via yargs-parser (>=16.0.0, <=18.1.0)

yargs-parser NPM version =16.0.0, =3.7.2, =6.0.4, =1.0.0, =1.0.2, =1.0.6, =1.4.0-alpha.1, =1.19.6, =1.0.0, =5.0.0, =2.0.0-beta.2, =2.0.0-beta.2, =2.3.2 and more Source cves: CVE-2020-7608 Source advisory: OSV:GHSA-P9PC-299P-VXGP...

yargs-parser Vulnerable to Prototype Pollution

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --foo.proto.bar...

CVE-2020-7608

A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a "proto" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

Prototype Pollution

Overview Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument...

yargs-parser input validation error vulnerability

yargs-parser is an option parser. An input validation error vulnerability exists in yargs-parser versions prior to 13.1.2, 14.0.0 and later fixed in 15.0.1, and 16.0.0 and later fixed in 18.1.1, which can be exploited to add or modify an Object.prototype property with the help of the 'proto'...

Prototype Pollution

yargs-parser is vulnerable to prototype pollution. The attack exists as it does not properly sanitize the key value provided by users, allowing the malicious properties of Object.prototype to be parsed or modified using a proto payload...

DEBIAN-CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

UBUNTU-CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

Design/Logic Flaw

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...

CVE-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...