Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later.
Update minimist to 1.2.3; minimist to 0.2.1; minimist to 1.2.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPrototype pollution in minimist affects minimist (npm), minimist (npm), minimist (npm). Severity is critical. This vulnerability is known to be exploited in the wild. Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later.
AI coding agents often install or upgrade packages automatically in npm. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| minimist |
Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later.
Update minimist to 1.2.3; minimist to 0.2.1; minimist to 1.2.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPrototype pollution in minimist affects minimist (npm), minimist (npm), minimist (npm). Severity is critical. This vulnerability is known to be exploited in the wild. Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`. ## Recommendation Upgrade to versions 0.2.1, 1.2.3 or later.
AI coding agents often install or upgrade packages automatically in npm. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| minimist |
| <1.2.3 |
| 1.2.3 |
| minimistnpm | >=0 <0.2.1 | 0.2.1 |
|---|
| minimistnpm | >=1.0.0 <1.2.3 | 1.2.3 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by OSV (osv).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| <1.2.3 |
| 1.2.3 |
| minimistnpm | >=0 <0.2.1 | 0.2.1 |
|---|
| minimistnpm | >=1.0.0 <1.2.3 | 1.2.3 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by OSV (osv).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard