Description

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Remediation

References

https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

Related Vulnerabilities

CVE-2020-36048 Vulnerability in maven package org.webjars.npm:engine.io

CVE-2022-23221 Vulnerability in maven package com.h2database:h2

CVE-2021-22204 Vulnerability in npm package exiftool-vendored

CVE-2017-1000228 Vulnerability in npm package ejs

CVE-2020-26302 Vulnerability in npm package is_js

Severity

Medium

Classification

CWE-1321 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Tags

Exploit Patch Third Party Advisory