Executive brief
This advisory was withdrawn by GitHub due to inaccuracies during CVE ingestion. The underlying vulnerabilities affected ESLint's dependencies (minimist and acorn libraries used by JavaScript development tools) and included regular expression denial-of-service flaws and prototype pollution issues that could crash development environments or allow code manipulation during parsing.
Technical details
This advisory was withdrawn and superseded by GHSA-vh95-rmgr-6w4m (minimist prototype pollution, CVE-2020-7598) and GHSA-6chw-6frg-f759 (acorn ReDoS). The minimist vulnerability involves improper sanitization of command-line arguments, allowing prototype pollution attacks that modify Object.prototype. The acorn vulnerability is a regular expression denial-of-service flaw triggered by malformed UTF-16 sequences like /[x-\ud800]/u that cause infinite loops in the parser. Both affect applications processing untrusted input. Patches are available for all affected versions.
Affected products
- npm minimist < 0.2.1 and >= 1.0.0, < 1.2.3
- npm acorn < 5.7.4, >= 6.0.0, < 6.4.1, >= 7.0.0, < 7.1.1
Timeline
- 2020-03-13: disclosed
- 2020-04-03: other: advisory withdrawn and replaced with GHSA-vh95-rmgr-6w4m and GHSA-6chw-6frg-f759