{"id":"CVE-2020-7608","aliases":["ALSA-2020:5499","ALSA-2021:0548","CLSA-2026-1774225193","CLSA-2026-1774225196","CLSA-2026-1774225198","CLSA-2026-1774225199","CLSA-2026-1777336759","DEBIAN-CVE-2020-7608","EUVD-2020-1208","GHSA-p9pc-299p-vxgp","MGASA-2021-0170","RHSA-2020:5305","RHSA-2020:5499","RHSA-2021:0521","RHSA-2021:0548","RLSA-2020:5499","RLSA-2021:0548","SNYK-JS-YARGSPARSER-560381","UBUNTU-CVE-2020-7608"],"status":"published","title":"yargs-parser Vulnerable to Prototype Pollution","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00514,"percentile":0.44118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-915"],"published":"2020-03-16T19:49:49Z","modified":"2026-10-29T11:12:09Z","fixes":[{"ecosystem":"npm","package":"yargs-parser","fixed_in":["13.1.2","15.0.1","5.0.1","18.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"yargs-parser","fixed_in":["11.1.1-tuxcare.1","7.0.0-tuxcare.1","10.1.0-tuxcare.1","4.2.1-tuxcare.1","13.1.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-yargs-parser","fixed_in":["18.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-yargs-parser","fixed_in":["18.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-yargs-parser","fixed_in":["18.1.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"nodejs-yargs-parser","fixed_in":["10.0.0-3.1.mga7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"13.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"15.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.0"},{"fixed":"5.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"18.1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.1-tuxcare.0"},{"fixed":"11.1.1-tuxcare.1"}]}],"versions":["11.1.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-tuxcare.0"},{"fixed":"7.0.0-tuxcare.1"}]}],"versions":["7.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-tuxcare.0"},{"fixed":"10.1.0-tuxcare.1"}]}],"versions":["10.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.1-tuxcare.0"},{"fixed":"4.2.1-tuxcare.1"}]}],"versions":["4.2.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.1.2-tuxcare.0"},{"fixed":"13.1.2-tuxcare.1"}]}],"versions":["13.1.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.1.1-1"}]}]},{"source":"osv","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"13.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"15.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"18.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"yargs-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs-yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-3.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.8-12.19.1.2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-10.23.1.2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-yargs-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-1","8.0.0-1"]}],"products":[{"vendor":"yargs","product":"yargs-parser"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.npmjs.com/advisories/1500","tags":["web"]},{"url":"https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","tags":["advisory"]},{"url":"https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p9pc-299p-vxgp"},{"url":"https://errata.almalinux.org/8/ALSA-2020-5499.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15366","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7608","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7774","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8277","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0548.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7608","tags":["advisory"]},{"url":"https://github.com/yargs/yargs-parser","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0170.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27975","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5305","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898680","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5305.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7608","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5499","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5499.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0521","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["advisory"]},{"url":"https://hackerone.com/reports/988103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0548","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:5499","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0548","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7608","tags":["report"]},{"url":"https://gist.github.com/Kirill89/dcd8100d010896157a36624119439832","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7608","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","status":"published","published":"2020-03-16T19:49:49Z","modified":"2024-08-04T09:33:19.972Z","updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-1208","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","status":"published","published":"2020-03-16T19:49:49Z","modified":"2024-08-04T09:33:19Z","updated_at":"2026-11-03T03:07:59.603443Z"}],"ghsa":[{"id":"GHSA-p9pc-299p-vxgp","title":"yargs-parser Vulnerable to Prototype Pollution","description":"Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  \nParsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.\n\n\n\n## Recommendation\n\nUpgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.","status":"published","published":"2020-09-04T18:00:54Z","modified":"2023-01-27T05:00:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:36:15.574072Z"}],"nvd":[{"id":"CVE-2020-7608","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","status":"published","published":"2020-03-16T20:15:12.86Z","modified":"2026-06-17T03:25:06.803Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:05:56.580228Z"}],"osv":[{"id":"CVE-2020-7608","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","status":"published","published":"2020-03-16T20:15:12.86Z","modified":"2026-10-29T11:12:04.791385661Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7608","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","status":"published","published":"2020-03-16T20:15:12.86Z","modified":"2026-10-26T12:00:26.439775786Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-p9pc-299p-vxgp","title":"yargs-parser Vulnerable to Prototype Pollution","description":"Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  \nParsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.\n\n\n\n## Recommendation\n\nUpgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.","status":"published","published":"2020-09-04T18:00:54Z","modified":"2026-07-08T06:49:37.726276553Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"RHSA-2020:5305","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:43:51Z","modified":"2026-10-13T10:01:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5499","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-09-13T22:43:02Z","modified":"2026-10-13T10:01:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:43:33Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:43:41Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2020:5499","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)","status":"published","published":"2020-12-15T16:03:21Z","modified":"2026-02-04T14:45:04.239839Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-02-04T20:15:14.123658Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-7608","description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","status":"published","published":"2020-03-16T20:15:00Z","modified":"2025-10-24T04:48:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2020:5499","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)","status":"published","published":"2020-12-15T16:03:21Z","modified":"2026-10-29T11:12:09.500731587Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-10-29T11:00:27.308699758Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1774225193","title":"TuxCare security update for yargs-parser (1 CVE)","description":"TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 11.1.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:01.520866203Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225196","title":"TuxCare security update for yargs-parser (1 CVE)","description":"TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 7.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:00.113624008Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225198","title":"TuxCare security update for yargs-parser (1 CVE)","description":"TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 10.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:00.922138257Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225199","title":"TuxCare security update for yargs-parser (1 CVE)","description":"TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 4.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:02.089836177Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1777336759","title":"TuxCare security update for yargs-parser (1 CVE)","description":"TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 13.1.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:47.564924522Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"MGASA-2021-0170","title":"Updated nodejs-yargs-parser packages fix security vulnerability","description":"yargs-parser could be tricked into adding or modifying properties of\nObject.prototype using a \"__proto__\" payload (CVE-2020-7608).\n","status":"published","published":"2021-04-02T20:25:05Z","modified":"2026-04-16T04:44:08.423756314Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}