Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Prototype Pollution in `minimist 1.2.5`

See original GitHub issue

My project has a Dependabot alert for minimist which is a dependency of svelte-check:

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

It looks like that repo is no longer maintained and it is recommended to use this fork instead. I’m just wondering if that’s something that’s in the pipeline.

Minimist is also a sub-dependency of svelte-preprocess, via sorcery, so same question for that project, too.

Thanks!

Issue Analytics

State:
Created 2 years ago
Comments:5 (2 by maintainers)

Top GitHub Comments

2reactions

Lucas-Angelocommented, Apr 4, 2022

rm -rf node_modules/
rm package-lock.json
In the package.json file it is possible to add the transitive dependency version.
```
"resolutions": {
    "minimist": "1.2.6"
},
```
npm install
npm audit

😃

1reaction

dominikgcommented, Mar 22, 2022

minimist 1.2.6 is available with this fixed. update your dependencies

Top Results From Across the Web

CVE-2021-44906 Prototype Pollution in minimist

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). I don't know how ...

Minimist <= 1.2.5 - Prototype Pollution - Wordfence

Description. Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). Fixed in 1.2.6.

Prototype pollution vulnerability in minimist npm package - Snyk

This security vulnerability that manifests as prototype pollution, enables attackers to overwrite a JavaScript application object prototype.

Prototype Pollution Vulnerability in the minimist library (+4 More)

minimist is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the `setKey ` function in the ...

Prototype Pollution in minimist - Vulners

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines...