Executive brief
minimist is a popular Node.js library for parsing command-line arguments. A prototype pollution vulnerability allows attackers who control the input arguments to modify the prototype of all JavaScript objects, potentially adding or altering properties that will exist on every object in the application. This could lead to unexpected behavior, application crashes, or enable further attacks depending on how the affected application uses these objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in how minimist parses command-line arguments. The library fails to properly sanitize arguments like --__proto__.y=Polluted or --__proto__=Polluted, allowing attackers to modify Object.prototype and inject malicious properties into all JavaScript objects. The attack requires the attacker to control the input arguments passed to minimist; if an application unsafely processes user-supplied arguments or accepts them from an untrusted source, the flaw becomes exploitable. Exploitation can cause application crashes or enable denial-of-service attacks. Patches are available in minimist versions 0.2.1 and 1.2.3 and later.
Affected products
- minimist minimist < 0.2.1, 1.0.0–1.2.2
Timeline
- 2020-03-11: disclosed
- 2020-04-03: advisory
- 2020-04-03: patched: versions 0.2.1 and 1.2.3