Yargs-parser, a crucial dependency for the popular yargs command-line argument parsing library, saw a version jump from 15.0.3 to 16.0.0. Both versions maintain the core functionality of parsing command-line arguments and boast shared dependencies: camelcase for converting strings to camel case and decamelize for the reverse process. The critical difference lies in the development dependencies. Version 15.0.3 utilized nyc for code coverage, while version 16.0.0 switched to c8. This change signifies a shift in the preferred code coverage tool, potentially indicating improved performance or feature set offered by c8. Other dev dependencies like chai, mocha, standard, coveralls, and standard-version were consistent between the versions, suggesting a stable testing and code style environment.
Despite the version numbering implying a significant change, the underlying functionality remains similar, making the upgrade relatively seamless for most users. Developers should note the change in the code coverage tool; if their workflow relies on specific nyc configurations, adjustments might be needed when upgrading to version 16.0.0. Furthermore, although the versions appear very similar at first glance, version 16 of the library has been released in late 2019 while version 15 has been released in mid 2021, that sounds like a mistake and developers should take this into account. Both are licensed under ISC and maintained in the yargs repository on GitHub, showcasing its open-source nature and community involvement. The dist field provides insights into the package size, where version 16.0.0 is slightly larger unpacked compared to 15.0.3.
All the vulnerabilities related to the version 16.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.