Yargs-parser, a crucial dependency for the widely used yargs command-line argument parser, saw a minor version bump from 17.0.0 to 17.0.1 in late February 2020. Both versions share the same core dependencies: camelcase for converting strings to camel case, and decamelize for the reverse operation. The development dependencies, including testing frameworks like chai and mocha, code coverage tools (c8, coveralls), and code style checkers (standard), also remained consistent between the two releases. This indicates a focus on stability and code quality.
However, a key difference lies in the repository URL specified in the "repository" field. Version 17.0.0 uses an SSH-based Git URL, while version 17.0.1 switches to an HTTPS-based URL. This seemingly minor change could impact developers accessing the repository, especially those in environments where SSH access is restricted. The update showcases a move towards accessibility and standardization. Another notable difference is the unpacked size of the package, increasing from 66789 bytes in 17.0.0 to 67157 bytes in 17.0.1, suggesting minor code additions or modifications, probably related to the mentioned standardization around URLs. Finally the release date is different, version 17.0.1 was released on 2020-02-29, about 2 weeks after version 17.0.0. Developers should consider these subtle differences when choosing which parser version to incorporate into their projects.
All the vulnerabilities related to the version 17.0.1 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.