Summary
A prototype pollution vulnerability was discovered in Minimist. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modication of an existing property that will exist on all objects.
Product
Minimist before version 0.2.1 and 1.2.x before 1.2.3.
Impact
If the attackers have control over the arguments being passed to minimist, they could crash the application, causing a denial of service.
Steps to reproduce
>>> require('minimist')(["--__proto__.y=Polluted"]);Expected result:
Parsing the argument --__proto__.y=Pollutedadds a y property with value Polluted to all objects which will raise an uncaught error and crashes the application.
Remediation
Update Minimist to 0.2.1 or 1.2.3 or above.
Credit
This issue was discovered and reported by Checkmarx Research Team.
