Yargs, a popular command-line argument parser for Node.js, released version 12.0.5 as a minor update succeeding version 12.0.4. Both versions maintain the core functionality of providing a modern, pirate-themed alternative to optimist, simplifying the process of building interactive command-line tools. The description and the dependencies , y18n, cliui, find-up, os-locale, decamelize, set-blocking, string-width, which-module, get-caller-file, require-directory, and require-main-filename remain consistent, ensuring that developers can rely on the same set of underlying utilities for internationalization, CLI interface building, file system navigation, and more. While the development dependencies like cpr, nyc, chai, chalk, mocha, which, rimraf, hashish, standard, coveralls, cross-spawn, es6-promise, standard-version, and yargs-test-extends also didn't change.
The primary difference lies in a minor update to the yargs-parser dependency. Version 12.0.5 uses yargs-parser version 11.1.1, while the previous version relied on 11.1.0. This seemingly small change can sometimes introduce bug fixes, performance improvements, or minor feature enhancements within the argument parsing logic.
Developers upgrading from 12.0.4 to 12.0.5 should review the changelog for yargs-parser version 11.1.1 to understand the specific changes included. The unpacked size saw a small augment from 217767 to 218045. For most users, this update is likely seamless, providing a slightly refined argument parsing experience.
All the vulnerabilities related to the version 12.0.5 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.