CVE-2021-44906: Prototype Pollution in minimist

March 17, 2022 (updated April 12, 2022)

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

References

github.com/advisories/GHSA-xvch-5gv4-984h
github.com/substack/minimist/blob/master/index.js
github.com/substack/minimist/issues/164
nvd.nist.gov/vuln/detail/CVE-2021-44906
snyk.io/vuln/SNYK-JS-MINIMIST-559764
stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068

Code Behaviors & Features

Detect and mitigate CVE-2021-44906 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →