Yargs is a lightweight tool designed to simplify option parsing in Node.js applications, providing developers with a straightforward method for handling command-line arguments and creating an argv hash without relying on complex optstrings. Version 1.0.7 and 1.0.6 of the library have minimal differences, as most of the core functionality remains identical between them. The package provides a clean and easy syntax to grab command arguments from your programs, which means it can be implemented effortlessly. This helps developers quickly integrate option parsing into projects of any scale.
Both versions depend on minimist for argument parsing and include tap and hashish as development dependencies for testing. The core functionality, focused on providing a simple argv hash, is consistent. The only notable difference sits in the release date. Version 1.0.7 was deployed on November 24, 2013, whereas version 1.0.6 was released a day before on November 23, 2013. While subtle, this might contain minor bug fixes or adjustments. Developers considering using Yargs should thus opt for version 1.0.7 for general use, as it contains the latest updates from the declared period. It’s a practical choice for projects needing basic argument parsing without added bulk.
All the vulnerabilities related to the version 1.0.7 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
