Description

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

Remediation

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

https://snyk.io/vuln/SNYK-JS-MINIMIST-559764

Related Vulnerabilities

CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-standalone-server

CVE-2022-2191 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2023-50766 Vulnerability in maven package org.sonatype.nexus.ci:nexus-jenkins-plugin

CVE-2019-12399 Vulnerability in maven package org.apache.kafka:kafka

CVE-2016-10027 Vulnerability in maven package org.igniterealtime.smack:smack-tcp

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Mailing List Third Party Advisory Exploit Patch CWE-1321