Minimist is a lightweight npm package designed for parsing command-line arguments passed to Node.js scripts. Both version 1.2.0 and the earlier stable version 1.1.3 share the same core functionality: efficiently interpreting command-line options using a simple and intuitive syntax. They both include the same development dependencies such as covert, tap, and tape suggesting a consistent testing and code coverage approach across versions. This means that both follow very similar development practices and quality assurance.
The critical difference lies in the version number itself, indicating bug fixes, minor enhancements, or security patches implemented in 1.2.0 compared to 1.1.3. While the specific changes aren't detailed in the provided data, developers *should* typically prefer the newer version (1.2.0) as it will incorporate improvements made since the release of 1.1.3. Given the similar metadata regarding dependencies, author and description, the update between these versions it's most likely a minor version update focused on fixing bugs or issues instead of introducing breaking changes. Developers looking for a reliable, zero-dependency solution for command-line argument processing can confidently use minimist, while prioritizing the newest readily available stable version.
All the vulnerabilities related to the version 1.2.0 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
