Is CVE-2021-44906 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-44906 being exploited in the wild.

How severe is CVE-2021-44906?

Low severity, with a CVSS score of 3.1, published 18 March 2022.

Which products and versions are affected?

minimist (npm) SEMVER:introduced=1.0.0,fixed=1.2.6.

Is there a fix for CVE-2021-44906?

Yes. minimist (npm): upgrade to 1.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-44906 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2021-44906?

Check whether you run minimist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-44906: minimist prototype pollution in argument parsing

CVE-2021-44906 · Severity: low · CVSS 3.1 · Published 2022-03-18

minimist is a popular command-line argument parser library used in thousands of Node.js applications. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript objects by crafting specially formatted command-line arguments, potentially leading to application crashes, unauthorized behavior, or code execution depending on how the parsed arguments are used downstream.

Technologies: minimist (npm). Vendors: npm.

Quick answers

Is CVE-2021-44906 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-44906 being exploited in the wild.
How severe is CVE-2021-44906?: Low severity, with a CVSS score of 3.1, published 18 March 2022.
Which products and versions are affected?: minimist (npm) SEMVER:introduced=1.0.0,fixed=1.2.6.
Is there a fix for CVE-2021-44906?: Yes. minimist (npm): upgrade to 1.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-44906 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2021-44906?: Check whether you run minimist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

minimist (npm): upgrade to 1.2.6 or later
```
npm install minimist@1.2.6
```

Technical details

The vulnerability is a prototype pollution flaw in the setKey() function (lines 69–95 of index.js) that fails to properly validate object keys when parsing command-line arguments. An attacker can craft arguments containing object property paths like --__proto__.polluted=true or --constructor.prototype.polluted=true to inject properties into the JavaScript object prototype, affecting all objects in the application. The vulnerability requires network or local access to supply crafted arguments to an application using minimist, with no authentication required. Exploitation can lead to application denial of service or behavior manipulation. The vulnerability was patched in minimist 1.2.6 (released 2022-03-18) and 0.2.4; applications using affected versions prior to these releases should update immediately.

Affected products

minimist minimist 0.0.0–0.2.3, 1.0.0–1.2.5

Identifiers

CVE-2021-44906
GHSA-xvch-5gv4-984h

Timeline

2022-03-18: disclosed: Advisory published (GHSA-xvch-5gv4-984h)
2022-03-18: patched: minimist 1.2.6 and 0.2.4 released with fixes

References

https://github.com/minimistjs/minimist/issues/11

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.