CVE-2020-7608
yargs-parser Vulnerable to Prototype Pollution
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
- Record
CVE-2020-7608- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE List No score
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
- Record
CVE-2020-7608- Updated
- 2026-11-02
EUVDEUVD-2020-1208 No score
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
- Record
EUVD-2020-1208- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p9pc-299p-vxgp
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Recommendation
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
- Record
GHSA-p9pc-299p-vxgp- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-915, CWE-1321
- Updated
- 2026-11-02
OSV
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
- Record
CVE-2020-7608- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-7608
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
- Record
DEBIAN-CVE-2020-7608- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 16 moreShow less
OSVGHSA-p9pc-299p-vxgp
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Recommendation
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
- Record
GHSA-p9pc-299p-vxgp- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-1321, CWE-915
- Updated
- 2026-11-02
OSVRHSA-2020:5305
Red Hat Security Advisory: rh-nodejs12-nodejs security update
- Record
RHSA-2020:5305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:5499
Red Hat Security Advisory: nodejs:12 security and bug fix update
- Record
RHSA-2020:5499- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0521
Red Hat Security Advisory: rh-nodejs10-nodejs security update
- Record
RHSA-2021:0521- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0548
Red Hat Security Advisory: nodejs:10 security update
- Record
RHSA-2021:0548- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2020:5499
Moderate: nodejs:12 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
-
nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
-
c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
-
nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)
- Record
RLSA-2020:5499- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2021:0548
Moderate: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (10.23.1).
Security Fix(es):
-
libuv: buffer overflow in realpath (CVE-2020-8252)
-
nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
-
nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
-
nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
-
nodejs-dot-prop: prototype pollution (CVE-2020-8116)
-
nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
-
npm: sensitive information exposure through logs (CVE-2020-15095)
-
nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
-
nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
-
nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2021:0548- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7608
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
- Record
UBUNTU-CVE-2020-7608- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVALSA-2020:5499 No score
Moderate: nodejs:12 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
-
nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
-
c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)
-
nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)
- Record
ALSA-2020:5499- Updated
- 2026-11-02
OSVALSA-2021:0548 No score
Moderate: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (10.23.1).
Security Fix(es):
-
libuv: buffer overflow in realpath (CVE-2020-8252)
-
nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
-
nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
-
nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
-
nodejs-dot-prop: prototype pollution (CVE-2020-8116)
-
nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
-
npm: sensitive information exposure through logs (CVE-2020-15095)
-
nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
-
nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
-
nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2021:0548- Updated
- 2026-11-02
OSVCLSA-2026-1774225193 No score
TuxCare security update for yargs-parser (1 CVE)
TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 11.1.1-tuxcare.1.
- Record
CLSA-2026-1774225193- Updated
- 2026-11-02
OSVCLSA-2026-1774225196 No score
TuxCare security update for yargs-parser (1 CVE)
TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 7.0.0-tuxcare.1.
- Record
CLSA-2026-1774225196- Updated
- 2026-11-02
OSVCLSA-2026-1774225198 No score
TuxCare security update for yargs-parser (1 CVE)
TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 10.1.0-tuxcare.1.
- Record
CLSA-2026-1774225198- Updated
- 2026-11-02
OSVCLSA-2026-1774225199 No score
TuxCare security update for yargs-parser (1 CVE)
TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 4.2.1-tuxcare.1.
- Record
CLSA-2026-1774225199- Updated
- 2026-11-02
OSVCLSA-2026-1777336759 No score
TuxCare security update for yargs-parser (1 CVE)
TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 13.1.2-tuxcare.1.
- Record
CLSA-2026-1777336759- Updated
- 2026-11-02
OSVMGASA-2021-0170 No score
Updated nodejs-yargs-parser packages fix security vulnerability
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload (CVE-2020-7608).
- Record
MGASA-2021-0170- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yargs-parsernpm |
6.0.0 up to 13.1.2 | 13.1.2 |
yargs-parsernpm |
14.0.0 up to 15.0.1 | 15.0.1 |
yargs-parsernpm |
through 5.0.0 | 5.0.1 |
yargs-parsernpm |
16.0.0 up to 18.1.1 | 18.1.1 |
nodejs-nodemonAlmaLinux:8 From an advisory covering 4 CVEs |
before 1.18.3-1.module_el8.3.0+2023+d2377ea3 | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
nodejs-nodemonAlmaLinux:8 From an advisory covering 4 CVEs |
before 1.18.3-1.module_el8.3.0+2047+b07ac28e | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
nodejs-packagingAlmaLinux:8 From an advisory covering 4 CVEs |
before 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e |
nodejs-packagingAlmaLinux:8 From an advisory covering 4 CVEs |
before 17-3.module_el8.4.0+2521+c668cc9f | 17-3.module_el8.4.0+2521+c668cc9f |
nodejs-packagingAlmaLinux:8 From an advisory covering 4 CVEs |
before 17-3.module_el8.3.0+2023+d2377ea3 | 17-3.module_el8.3.0+2023+d2377ea3 |
nodejs-nodemonAlmaLinux:8 From an advisory covering 10 CVEs |
before 1.18.3-1.module_el8.3.0+2023+d2377ea3 | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nodejs-nodemonAlmaLinux:8 From an advisory covering 10 CVEs |
before 1.18.3-1.module_el8.3.0+2047+b07ac28e | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
nodejs-packagingAlmaLinux:8 From an advisory covering 10 CVEs |
before 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e |
nodejs-packagingAlmaLinux:8 From an advisory covering 10 CVEs |
before 17-3.module_el8.4.0+2521+c668cc9f | 17-3.module_el8.4.0+2521+c668cc9f |
nodejs-packagingAlmaLinux:8 From an advisory covering 10 CVEs |
before 17-3.module_el8.3.0+2023+d2377ea3 | 17-3.module_el8.3.0+2023+d2377ea3 |
yargs-parserTuxCare:npm |
11.1.1-tuxcare.0 up to 11.1.1-tuxcare.1, plus listed versions 11.1.1 |
11.1.1-tuxcare.1 |
yargs-parserTuxCare:npm |
7.0.0-tuxcare.0 up to 7.0.0-tuxcare.1, plus listed versions 7.0.0 |
7.0.0-tuxcare.1 |
yargs-parserTuxCare:npm |
10.1.0-tuxcare.0 up to 10.1.0-tuxcare.1, plus listed versions 10.1.0 |
10.1.0-tuxcare.1 |
yargs-parserTuxCare:npm |
4.2.1-tuxcare.0 up to 4.2.1-tuxcare.1, plus listed versions 4.2.1 |
4.2.1-tuxcare.1 |
yargs-parserTuxCare:npm |
13.1.2-tuxcare.0 up to 13.1.2-tuxcare.1, plus listed versions 13.1.2 |
13.1.2-tuxcare.1 |
node-yargs-parserDebian:12 |
before 18.1.1-1 | 18.1.1-1 |
node-yargs-parserDebian:13 |
before 18.1.1-1 | 18.1.1-1 |
node-yargs-parserDebian:14 |
before 18.1.1-1 | 18.1.1-1 |
yargs-parsernpm |
before 5.0.1 | 5.0.1 |
nodejs-yargs-parserMageia:7 |
before 10.0.0-3.1.mga7 | 10.0.0-3.1.mga7 |
rh-nodejs12-nodejsRed Hat:rhel_software_collections:3::el7 From an advisory covering 4 CVEs |
before 0:12.19.1-2.el7 | 0:12.19.1-2.el7 |
rh-nodejs12-nodejs-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 4 CVEs |
before 0:12.19.1-2.el7 | 0:12.19.1-2.el7 |
rh-nodejs12-nodejs-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 4 CVEs |
before 0:12.19.1-2.el7 | 0:12.19.1-2.el7 |
rh-nodejs12-nodejs-docsRed Hat:rhel_software_collections:3::el7 From an advisory covering 4 CVEs |
before 0:12.19.1-2.el7 | 0:12.19.1-2.el7 |
rh-nodejs12-npmRed Hat:rhel_software_collections:3::el7 From an advisory covering 4 CVEs |
before 0:6.14.8-12.19.1.2.el7 | 0:6.14.8-12.19.1.2.el7 |
nodejsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
nodejs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
nodejs-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
nodejs-develRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
nodejs-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
nodejs-full-i18nRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 | 1:12.19.1-1.module+el8.3.0+8851+b7b41ca0 |
nodejs-nodemonRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
nodejs-packagingRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:17-3.module+el8.1.0+3369+37ae6a45 | 0:17-3.module+el8.1.0+3369+37ae6a45 |
npmRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0 | 1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0 |
rh-nodejs10-nodejsRed Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs |
before 0:10.23.1-2.el7 | 0:10.23.1-2.el7 |
rh-nodejs10-nodejs-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs |
before 0:10.23.1-2.el7 | 0:10.23.1-2.el7 |
rh-nodejs10-nodejs-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs |
before 0:10.23.1-2.el7 | 0:10.23.1-2.el7 |
rh-nodejs10-nodejs-docsRed Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs |
before 0:10.23.1-2.el7 | 0:10.23.1-2.el7 |
rh-nodejs10-npmRed Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs |
before 0:6.14.10-10.23.1.2.el7 | 0:6.14.10-10.23.1.2.el7 |
nodejsRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
nodejs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
nodejs-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
nodejs-develRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
nodejs-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
nodejs-full-i18nRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:10.23.1-1.module+el8.3.0+9502+012d8a97 | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
nodejs-nodemonRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 0:1.18.3-1.module+el8+2632+6c5111ed | 0:1.18.3-1.module+el8+2632+6c5111ed |
nodejs-packagingRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 0:17-3.module+el8+2873+aa7dfd9a | 0:17-3.module+el8+2873+aa7dfd9a |
npmRed Hat:enterprise_linux:8::appstream From an advisory covering 10 CVEs |
before 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97 | 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97 |
nodejs-nodemonRocky Linux:8 From an advisory covering 4 CVEs |
before 0:1.18.3-1.module+el8.3.0+101+f84c7154 | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
nodejs-packagingRocky Linux:8 From an advisory covering 4 CVEs |
before 0:17-3.module+el8.3.0+101+f84c7154 | 0:17-3.module+el8.3.0+101+f84c7154 |
nodejs-nodemonRocky Linux:8 From an advisory covering 10 CVEs |
before 0:1.18.3-1.module+el8.3.0+101+f84c7154 | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
nodejs-packagingRocky Linux:8 From an advisory covering 10 CVEs |
before 0:17-3.module+el8.3.0+101+f84c7154 | 0:17-3.module+el8.3.0+101+f84c7154 |
node-yargs-parserUbuntu:18.04:LTS |
All versions, plus listed versions 4.1.0-18.0.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7608 is a medium vulnerability (CVSS 5.3) in Yargs Yargs-parser, published March 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 44th percentile. Fixed in yargs-parser 13.1.2.
References
snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
npmjs.com/advisories/1500
github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2
nvd.nist.gov/vuln/detail/CVE-2020-7608
Show 78 moreShow less
errata.almalinux.org/8/ALSA-2020-5499.html
vulners.com/cve/CVE-2020-15366
security-tracker.debian.org/tracker/CVE-2020-7608
advisories.mageia.org/MGASA-2021-0170.html
bugs.mageia.org/show_bug.cgi?id=27975
access.redhat.com/errata/RHSA-2020:5305
bugzilla.redhat.com/show_bug.cgi?id=1857977
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5305.json
cve.org/CVERecord?id=CVE-2020-7608
hackerone.com/reports/719856
errata.rockylinux.org/RLSA-2020:5499
ubuntu.com/security/CVE-2020-7608
gist.github.com/Kirill89/dcd8100d010896157a36624119439832