Lucene search
Veracode Vulnerability DatabaseVERACODE:34731HistoryMar 18, 2022 - 2:42 a.m.
Prototype Pollution
2022-03-1802:42:04
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
61
0.035 Low
EPSS
Percentile
91.6%
minimist is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the setKey function in the index.js and modify attributes such as __proto__, constructor, and prototype.
References
github.com/advisories/GHSA-xvch-5gv4-984h
github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip
github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d
github.com/substack/minimist/blob/master/index.js#L69
github.com/substack/minimist/issues/164
stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068
Related
ibm
ibm
Security Bulletin: IBM Cognos Analytics has addressed a vulnerability (CVE-2021-44906)
2023-07-27 21:13:11
Security Bulletin: Open Source Dependency Vulnerability
2023-05-15 17:14:54
prion
prion
Code injection
2022-03-17 16:15:00
ubuntucve
ubuntucve
CVE-2021-44906
2022-03-17 00:00:00
nessus
nessus
RHEL 8 : minimist (Unpatched Vulnerability)
2024-05-11 00:00:00
CentOS 9 : nodejs-nodemon-2.0.20-2.el9
2024-02-29 00:00:00
githubexploit
githubexploit
Exploit for Prototype Pollution in Substack Minimist
2023-10-02 15:20:35
cve
cve
CVE-2021-44906
2022-03-17 16:15:07
cvelist
cvelist
CVE-2021-44906
2022-03-17 13:05:57
redos
redos
ROS-20240507-05
2024-05-07 00:00:00
debiancve
debiancve
CVE-2021-44906
2022-03-17 16:15:07
osv
osv
Prototype Pollution in minimist
2022-03-18 00:01:09
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0035)
2023-03-28 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:1466-1)
2022-04-29 00:00:00
openSUSE: Security Advisory for nodejs8 (SUSE-SU-2022:1694-1)
2022-05-17 00:00:00
github
github
Prototype Pollution in minimist
2022-03-18 00:01:09
nvd
nvd
CVE-2021-44906
2022-03-17 16:15:07
mageia
mageia
Updated nodejs-minimist packages fix security vulnerability
2023-02-07 03:06:39
redhatcve
redhatcve
CVE-2021-44906
2022-03-19 23:40:42
thn
thn
redhat
redhat
suse
suse
Security update for nodejs8 (moderate)
2022-05-17 00:00:00
Security update for nodejs12 (important)
2022-04-28 00:00:00
Security update for nodejs14 (important)
2022-04-28 00:00:00
rocky
rocky
nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-23 14:30:11
nodejs:14 security, bug fix, and enhancement update
2023-01-09 14:24:14
nodejs:16 security, bug fix, and enhancement update
2022-12-15 15:42:25
almalinux
almalinux
Moderate: nodejs:14 security, bug fix, and enhancement update
2023-01-09 00:00:00
Moderate: nodejs:16 security, bug fix, and enhancement update
2022-12-15 00:00:00
oraclelinux
oraclelinux
nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-24 00:00:00
nodejs:14 security, bug fix, and enhancement update
2023-01-09 00:00:00
nodejs:16 security, bug fix, and enhancement update
2022-12-16 00:00:00
checkpoint_advisories
checkpoint_advisories