# CVE-2021-44906: minimist prototype pollution in argument parsing

Source: https://junglewise.ai/threats/cve-2021-44906-minimist-prototype-pollution-in-argument-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-44906 · Severity: low · CVSS 3.1 · Published 2022-03-18

minimist is a popular command-line argument parser library used in thousands of Node.js applications. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript objects by crafting specially formatted command-line arguments, potentially leading to application crashes, unauthorized behavior, or code execution depending on how the parsed arguments are used downstream.

Technologies: [minimist (npm)](https://junglewise.ai/threats/technologies/minimist). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-44906 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-44906 being exploited in the wild.

**How severe is CVE-2021-44906?** Low severity, with a CVSS score of 3.1, published 18 March 2022.

**Which products and versions are affected?** minimist (npm) SEMVER:introduced=1.0.0,fixed=1.2.6.

**Is there a fix for CVE-2021-44906?** Yes. minimist (npm): upgrade to 1.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-44906 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2021-44906?** Check whether you run minimist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- minimist (npm): upgrade to 1.2.6 or later

  ```sh
  npm install minimist@1.2.6
  ```


## Technical details

The vulnerability is a prototype pollution flaw in the setKey() function (lines 69–95 of index.js) that fails to properly validate object keys when parsing command-line arguments. An attacker can craft arguments containing object property paths like --__proto__.polluted=true or --constructor.prototype.polluted=true to inject properties into the JavaScript object prototype, affecting all objects in the application. The vulnerability requires network or local access to supply crafted arguments to an application using minimist, with no authentication required. Exploitation can lead to application denial of service or behavior manipulation. The vulnerability was patched in minimist 1.2.6 (released 2022-03-18) and 0.2.4; applications using affected versions prior to these releases should update immediately.

## Affected products

- minimist minimist 0.0.0–0.2.3, 1.0.0–1.2.5

## Identifiers

- CVE-2021-44906
- GHSA-xvch-5gv4-984h

## Timeline

- 2022-03-18: disclosed: Advisory published (GHSA-xvch-5gv4-984h)
- 2022-03-18: patched: minimist 1.2.6 and 0.2.4 released with fixes

## References

- [https://github.com/minimistjs/minimist/issues/11](https://github.com/minimistjs/minimist/issues/11)

## Related threats

- [minimist prototype pollution](https://junglewise.ai/threats/cve-2020-7598-minimist-prototype-pollution)
- [ESLint dependencies ReDoS and prototype pollution (withdrawn)](https://junglewise.ai/threats/eslint-dependencies-redos-and-prototype-pollution-withdrawn-4ea1cc63)