Executive brief
yargs-parser is a command-line argument parser library used in Node.js applications. A prototype pollution vulnerability allows attackers who control arguments passed to the parser to modify core JavaScript object properties, potentially affecting all objects in the application and leading to property injection or manipulation attacks.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) where argument parsing does not properly sanitize user-controlled input. An attacker who controls the arguments passed to yargs-parser can craft payloads like "--foo.__proto__.bar baz" that pollute Object.prototype by adding or modifying properties. This affects all downstream objects in the application. The attack requires control over the arguments being parsed and is exploitable if those arguments derive from untrusted sources. Patches are available in versions 5.0.1, 13.1.2, 15.0.1, and 18.1.1 or later, depending on the major version line in use.
Affected products
- yargs yargs-parser < 5.0.1, 6.0.0–13.1.1, 14.0.0–15.0.0, 16.0.0–18.1.0
Timeline
- 2020-09-04: disclosed
- 2020-03-16: patched: Multiple patches released across version lines: 5.0.1, 13.1.2, 15.0.1, 18.1.1