@alib/build-scripts (>=0.1.0-0, <=1.0.0-0), @alicd/cone-build-scripts (>=0.1.0, <=0.1.2) +220 more potentially affected by CVE-2020-7608 via yargs-parser (>=14.0.0, <=15.0.0)

yargs-parser NPM version =14.0.0, =0.1.0-0, =0.1.0, =0.1.1-1, =0.1.1-1, =0.1.1-1, =0.1.0, =0.3.1, =1.0.22-alpha.2, =1.3.0-alpha.1, =0.1.0-alpha.3, =0.1.7-alpha.1, =0.2.4-alpha.1, =0.3.4 and more Source cves: CVE-2020-7608 Source advisory: SNYK:JS-YARGSPARSER-560381...

00.demo (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +39538 more potentially affected by CVE-2020-7608 via yargs-parser (>=6.0.1, <=13.1.1)

yargs-parser NPM version =6.0.1, =1.0.0, =1.0.0, =8.3.5, =0.1.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2020-7608 Source advisory: SNYK:JS-YARGSPARSER-560381...

Prototype Pollution

Overview yargs-parser is a mighty option parser used by yargs. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of Object.prototype using a proto payload. Our research team checked several attack vectors to...

CVE-2020-7608: Improperly Controlled Modification of Object Prototype Attributes

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload...