Yargs, a popular command-line argument parser for Node.js, released version 6.6.0 as an update to the previous stable version 6.5.0. Both versions share the same core functionality, continuing yargs' tradition as a "modern, pirate-themed, successor to optimist," aimed at simplifying command-line interface creation. The primary difference between the two versions lies in their dependencies to other packages. Notably, version 6.6.0 replaces the "window-size" dependency, present in 6.5.0, with the "os-locale" dependency.This might indicate improved handling of terminal dimensions and localization. Developers should consider the implications of this change, especially if their applications relied on the specific behavior of "window-size". Both versions use a range of dependencies for tasks such as internationalization ("y18n"), command-line interface styling ("cliui"), string manipulation ("camelcase", "decamelize", "string-width"), module loading ("read-pkg-up", "require-directory", "require-main-filename", "which-module", "get-caller-file"), and process control ("set-blocking"). Development dependencies, which are used for testing and building the package, remain largely consistent, with tools like Mocha, Chai, and Standard being used for test automation, code linting, and style checking. The library is licensed under the permissive MIT license, allowing broad usage and modification. Version 6.6.0 was released on December 30, 2016 (while 6.5.0 on December 1, 2016). Developers should evaluate the "window-size" to "os-locale" transition when deciding which version best suits their needs.
All the vulnerabilities related to the version 6.6.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.