MediumGHSA-vh95-rmgr-6w4mCVE-2020-7598

Prototype Pollution in minimist

Published 3 Apr 2020 · Updated 13 Mar 2026

Affected packages

minimistnpm
Affected
<0.2.1
Fixed in
0.2.1
Update to the fixed version for your release line, for example:npm install minimist@0.2.1
minimistnpm
Affected
>=1.0.0 <1.2.3
Fixed in
1.2.3
Update to the fixed version for your release line, for example:npm install minimist@1.2.3

Details

Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to minimist.

Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.

Is GHSA-vh95-rmgr-6w4m in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected minimist, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.