Description

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Remediation

References

https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

Related Vulnerabilities

CVE-2023-48240 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-api

CVE-2020-7690 Vulnerability in maven package org.webjars.npm:jspdf

CVE-2020-28472 Vulnerability in maven package org.webjars.bower:aws-sdk

CVE-2021-40865 Vulnerability in maven package org.apache.storm:storm-server

CVE-2022-43426 Vulnerability in maven package io.jenkins.plugins:s3explorer

Severity

Medium

Classification

CWE-1321 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Tags

Exploit Patch Third Party Advisory