Vulnerability · Published Mar 11, 2020 · Assigned by snyk
CVE-2020-7598
Medium 5.6
In plain English
A medium-severity security flaw in minimist. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.6Medium
Exploit odds (30 days)1.9%top 19.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e | ALSA-2020:2852 |
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e | ALSA-2020:2848 |
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2020:2852 |
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2020:2848 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e | ALSA-2020:2852 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f | ALSA-2020:2852 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2020:2852 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e | ALSA-2020:2848 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f | ALSA-2020:2848 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2020:2848 |
| Debian:12 | node-minimist | 1.2.5-1 | DEBIAN-CVE-2020-7598 |
| Debian:13 | node-minimist | 1.2.5-1 | DEBIAN-CVE-2020-7598 |
| Debian:14 | node-minimist | 1.2.5-1 | DEBIAN-CVE-2020-7598 |
| Rocky Linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2020:2848 |
| Rocky Linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2020:2852 |
| Rocky Linux:8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 | RLSA-2020:2852 |
| Rocky Linux:8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 | RLSA-2020:2848 |
| npm | minimist | 1.2.3 | GHSA-vh95-rmgr-6w4m |
| npm | minimist | 0.2.1 | GHSA-vh95-rmgr-6w4m |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 x_refsource_MISC
- openSUSE-SU-2020:0802 vendor-advisory, x_refsource_SUSE