Yargs-parser version 15.0.0 represents an incremental update over the previous stable version 14.0.0, both maintaining their core function as a robust option parser widely employed by the Yargs command-line argument processing library. From a dependency standpoint, both versions share identical requirements, leveraging camelcase and decamelize, and the suite of devDependencies remains consistent, including tools like nyc, chai, mocha, standard, coveralls, and standard-version for testing, linting, and development workflow. The key distinction between the two versions lies in the updated release date and the increment in the unpacked size. Version 15.0.0 was released on October 7, 2019, and had an unpacked size of 61655 bytes, whereas version 14.0.0 was released on September 6, 2019, with an unpacked size of 61025 bytes. This difference in size may indicate minor bug fixes, performance improvements, or small feature additions that don't fundamentally alter the API or dependencies.
For developers considering using yargs-parser, both versions offer a stable foundation for option parsing needs. The library remains lightweight and focused, using commonly used packages such as camelcase and decamelize, and doesn't appear to introduce any breaking changes between these releases. While the specific nature of the changes in 15.0.0 isn't explicitly stated in the metadata, the bump suggests an improvement worth adopting for new projects, or for existing ones who value staying up-to-date.
All the vulnerabilities related to the version 15.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.