Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prototype Pollution in minimist #276

Open
1 of 4 tasks
TheKingTermux opened this issue Feb 28, 2023 · 3 comments
Open
1 of 4 tasks

Prototype Pollution in minimist #276

TheKingTermux opened this issue Feb 28, 2023 · 3 comments
Assignees
@TheKingTermux
Labels
Auto Create Issues Label for Auto Created Issues Critical This label for Security Severity only do-not-autoclose Make bot can't close an Issues or PRs Security Label for Security Issues
Milestone
Alice 1.0.6

Comments

@TheKingTermux
Copy link
Owner

Description

Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Severity Check

  • Low
  • Moderate
  • High
  • Critical

Severity Number

9.8 / 10

CVSS base metrics

  • Attack vector
    Network

  • Attack complexity
    Low

  • Privileges required
    None

  • User interaction
    None

  • Scope
    Unchanged

  • Confidentiality
    High

  • Integrity
    High

  • Availability
    High

  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Weaknesses
    CWE-1321

  • CVE ID
    CVE-2021-44906

  • GHSA ID
    GHSA-xvch-5gv4-984h

Information

Package minimist (npm)

Affected versions

= 1.0.0, < 1.2.6
< 0.2.4

Patched versions
1.2.6
0.2.4

References
@TheKingTermux TheKingTermux added do-not-autoclose Make bot can't close an Issues or PRs Security Label for Security Issues Auto Create Issues Label for Auto Created Issues labels Feb 28, 2023
@TheKingTermux TheKingTermux self-assigned this Feb 28, 2023
@TheKingTermux TheKingTermux added this to the Alice 1.0.6 milestone Feb 28, 2023
@github-actions github-actions bot added the no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days label Apr 30, 2023
Repository owner deleted a comment from github-actions bot Apr 30, 2023
@TheKingTermux TheKingTermux removed the no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days label Apr 30, 2023
@TheKingTermux TheKingTermux added the Critical This label for Security Severity only label May 9, 2023
@github-actions

This comment has been minimized.

Sign in to view
@github-actions github-actions bot added the no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days label Jul 9, 2023
@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Jul 17, 2023
@TheKingTermux TheKingTermux removed the no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days label Jul 17, 2023
@TheKingTermux TheKingTermux reopened this Jul 17, 2023
@github-actions

This comment has been minimized.

Sign in to view
@github-actions github-actions bot added the no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days label Sep 16, 2023
@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Sep 23, 2023
@TheKingTermux TheKingTermux reopened this Sep 25, 2023
@github-actions github-actions bot removed the no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days label Sep 25, 2023
@github-actions GitHub Actions
Copy link

Isu ini sudah tidak ada perkembangan

@github-actions github-actions bot added no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days and removed no-issue-activity Label for Automatic Bot for Closing the Issues or PRs if not fixed anything in several days labels Nov 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@TheKingTermux TheKingTermux

Labels
Auto Create Issues Label for Auto Created Issues Critical This label for Security Severity only do-not-autoclose Make bot can't close an Issues or PRs Security Label for Security Issues
Projects
None yet
Milestone
Alice 1.0.6
Development

No branches or pull requests
1 participant
@TheKingTermux