CVE-2020-7598 @ Npm-minimist-1.2.0

[CMaheshBL]

Vulnerable Package issue exists @ Npm-minimist-1.2.0 in branch master

Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --proto.y=Polluted adds a y property with value Polluted to all objects. The argument --proto=Polluted raises an uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.

Namespace: CMaheshBL
Repository: NodeGoat
Repository Url: https://github.com/CMaheshBL/NodeGoat
CxAST-Project: CMaheshBL/NodeGoat
CxAST platform scan: d7c1c0af-6b2d-455e-8753-a6b87dbf733d
Branch: master
Application: NodeGoat
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-1321

---

Addition Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: LOW
Remediation Upgrade Recommendation: 1.2.6

---

References
Advisory
Commit
Commit