Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Recommendation
Upgrade to versions 0.2.1, 1.2.3 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | minimist | < 0.2.1, >= 1.0.0, < 1.2.3 | 0.2.1, 1.2.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7598
- https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68
- https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab
- https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95
- https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94
- https://github.com/substack/minimist
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://www.npmjs.com/advisories/1179
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-1321- Platform
- npm
- Package
minimist- Disclosed
- 03.04.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vh95-rmgr-6w4m - CC BY 4.0
Vulnerability history: minimist
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2020 03.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Medium 1
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Prototype Pollution in minimist this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.