{"id":"CVE-2020-7608","aliases":["GHSA-p9pc-299p-vxgp","SNYK-JS-YARGSPARSER-560381"],"url":"https://o3.security/vulnerability/CVE-2020-7608","summary":"yargs-parser Vulnerable to Prototype Pollution","details":"Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  \nParsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.\n\n\n\n## Recommendation\n\nUpgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.","published":"2020-03-16T20:15:12.860Z","modified":"2026-07-08T06:49:37.726276553Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"yargs-parser","fixedVersion":"13.1.2"},{"ecosystem":"npm","name":"yargs-parser","fixedVersion":"15.0.1"},{"ecosystem":"npm","name":"yargs-parser","fixedVersion":"18.1.1"},{"ecosystem":"npm","name":"yargs-parser","fixedVersion":"5.0.1"}],"fix":{"url":"https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36","label":"yargs/yargs-parser@1c417bd"},"references":[{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608"},{"type":"WEB","url":"https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"},{"type":"WEB","url":"https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2"},{"type":"PACKAGE","url":"https://github.com/yargs/yargs-parser"},{"type":"WEB","url":"https://www.npmjs.com/advisories/1500"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:49:37.726276553Z"}}