Loading vulnerability…
Prototype pollution in minimist
CVE-2021-44906 is a prototype-pollution vulnerability in the minimist JavaScript argument-parsing library, reported in versions 1.2.5 and earlier. An incomplete fix for CVE-2020-7598 allows crafted constructor or proto payloads processed by setKey() to add or modify Object.prototype properties. Exploitation requires control over arguments passed to a script using vulnerable minimist and can alter application behavior through inherited properties.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Prototype pollution can manipulate application logic and potentially permit modification or reading of application data. Incompatible overridden attributes can cause an application to crash, exit, or restart. Consequences depend on how the application uses polluted properties. Red Hat identifies narrower effects in its products, describing pollution of functions rather than all generic objects and requiring attacker control of Node.js script arguments.
If you can’t patch tonight, do this now.
Until updates are deployed, prevent untrusted parties from influencing Node.js command-line arguments processed by minimist. Reject or sanitize constructor and proto property paths before parsing, and avoid merging parsed untrusted objects into security-sensitive application state.
Patch, then assume compromise.
Upgrade minimist to version 1.2.6 or later on the 1.x branch, or version 0.2.4 or later on the 0.x branch. For bundled dependencies, install the applicable vendor security update. Available updates include JBoss EAP 7.4.6, JBoss EAP 7.3.12 for the affected EUS deployment, Red Hat Single Sign-On 7.6.2, and the applicable Red Hat Node.js security packages. Tanzu deployments should apply the applicable buildpack update, including .NET Core Buildpack 2.4.109. Account for vendor-backported fixes rather than relying solely on upstream version comparisons.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.