minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto " payload.
5.6CVSS
6.4AI Score
0.001EPSS
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
9.8CVSS
9.3AI Score
0.035EPSS