CVE-2020-7598: minimist prototype pollution

CVE-2020-7598 · Severity: low · CVSS 3.1 · Published 2020-04-03

minimist is a popular Node.js library for parsing command-line arguments. A prototype pollution vulnerability allows attackers who control the input arguments to modify the prototype of all JavaScript objects, potentially adding or altering properties that will exist on every object in the application. This could lead to unexpected behavior, application crashes, or enable further attacks depending on how the affected application uses these objects.

Technologies: minimist (npm). Vendors: npm.

Quick answers

Is CVE-2020-7598 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-7598 being exploited in the wild.
How severe is CVE-2020-7598?
Low severity, with a CVSS score of 3.1, published 3 April 2020.
Which products and versions are affected?
minimist (npm) SEMVER:introduced=0,fixed=0.2.1.
Is there a fix for CVE-2020-7598?
Yes. minimist (npm): upgrade to 0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7598 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-7598?
Check whether you run minimist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • minimist (npm): upgrade to 0.2.1 or later
    npm install minimist@0.2.1

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in how minimist parses command-line arguments. The library fails to properly sanitize arguments like --__proto__.y=Polluted or --__proto__=Polluted, allowing attackers to modify Object.prototype and inject malicious properties into all JavaScript objects. The attack requires the attacker to control the input arguments passed to minimist; if an application unsafely processes user-supplied arguments or accepts them from an untrusted source, the flaw becomes exploitable. Exploitation can cause application crashes or enable denial-of-service attacks. Patches are available in minimist versions 0.2.1 and 1.2.3 and later.

Affected products

  • minimist minimist < 0.2.1, 1.0.0–1.2.2

Identifiers

  • CVE-2020-7598
  • GHSA-vh95-rmgr-6w4m

Timeline

  • 2020-03-11: disclosed
  • 2020-04-03: advisory
  • 2020-04-03: patched: versions 0.2.1 and 1.2.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.