Read the docs
TI-2020-06120 Aliases CVE-2020-7598GHSA-vh95-rmgr-6w4m

Prototype pollution in minimist

Priority LOW 35CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 12 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01931 80th percentileScored 2026-11-07
Fix Partial minimist (npm): 0.2.1, 1.2.3Red Hat: 12 advisoriesRed Hat: 12 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—minimistAll versions prior to version 1.2.2—No fix listedCNA
—minimist (npm)before 0.2.10.2.1Patch availableGHSA-vh95-rmgr-6w4m
—minimist (npm)1.0.0 to before 1.2.31.2.3Patch availableGHSA-vh95-rmgr-6w4m
  • minimist Vendor— Affected All versions prior to version 1.2.2 Fixed in — No fix listed CNA
  • minimist (npm) Vendor— Affected before 0.2.1 Fixed in 0.2.1 Patch available GHSA-vh95-rmgr-6w4m
  • minimist (npm) Vendor— Affected 1.0.0 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-vh95-rmgr-6w4m

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:substack:minimist:*:*:*:*:*:node.js:*:*before 1.2.2VulnerableSubstack
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:substack:minimist:*:*:*:*:*:node.js:*:* Versions before 1.2.2 Vulnerable ·Substack
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-vh95-rmgr-6w4m minimist (npm) Fixed in 0.2.1 Advisory →
  • Fix · GHSA-vh95-rmgr-6w4m minimist (npm) Fixed in 1.2.3 Advisory →

Red Hat 12 advisories

  • RHSA-2021:2643 Released 2021-07-14 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.38 extras and security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-kibana6
  • RHSA-2020:4298 Released 2020-10-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.1 image security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-ansible-operator, openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers +47
  • RHSA-2020:3247 Released 2020-08-04 · Red Hat rating Important
    RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 novnc-1.1.0-1.el8ost, ovirt-engine-4.4.1.8-0.7.el8ev, ovirt-engine-api-explorer-0.0.6-1.el8ev +21
Show 9 more Red Hat advisories
  • RHSA-2020:2992 Released 2020-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 3.11 security update
    • Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-redistributable-3.11.248-1.git.0.92ee8ac.el7 +12
  • RHSA-2020:3084 Released 2020-07-21 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
  • RHSA-2020:3042 Released 2020-07-21 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) nodejs-1:10.21.0-3.module+el8.0.0+7067+054302d1.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.0.0+7067+054302d1.src::nodejs:10, nodejs-1:10.21.0-3.module+el8.0.0+7067+054302d1.x86_64::nodejs:10 +11
  • RHSA-2020:2895 Released 2020-07-13 · Red Hat rating Important
    rh-nodejs12-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
  • RHSA-2020:2852 Released 2020-07-07 · Red Hat rating Important
    nodejs:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.aarch64::nodejs:12, nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.ppc64le::nodejs:12, nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.s390x::nodejs:12 +19
  • RHSA-2020:2848 Released 2020-07-07 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.21.0-3.module+el8.2.0+7071+d2377ea3.aarch64::nodejs:10, nodejs-1:10.21.0-3.module+el8.2.0+7071+d2377ea3.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.2.0+7071+d2377ea3.s390x::nodejs:10 +19
  • RHSA-2020:2849 Released 2020-07-07 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64::nodejs:10, nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.s390x::nodejs:10 +19
  • RHSA-2020:2847 Released 2020-07-07 · Red Hat rating Important
    nodejs:12 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.18.2-1.module+el8.1.0+7232+f8b5ede5.aarch64::nodejs:12, nodejs-1:12.18.2-1.module+el8.1.0+7232+f8b5ede5.ppc64le::nodejs:12, nodejs-1:12.18.2-1.module+el8.1.0+7232+f8b5ede5.s390x::nodejs:12 +19
  • RHSA-2020:2362 Released 2020-06-02 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh security update
    • OpenShift Service Mesh 1.0 servicemesh-grafana-6.2.2-36.el8, servicemesh-grafana-prometheus-6.2.2-36.el8
    • Red Hat OpenShift Service Mesh 1.0 jaeger-v1.13.1.redhat7-1.el7, kiali-v1.0.11.redhat1-1.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
OpenShift Service Mesh 1.0Fixed RHSA-2020:2362
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2020:3247
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:2848, RHSA-2020:2852
Red Hat Enterprise Linux AppStream E4S (v. 8.0)Fixed RHSA-2020:3042
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2020:2847, RHSA-2020:2849
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2020:2992
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2020:4298, RHSA-2021:2643
Red Hat OpenShift Service Mesh 1.0Fixed RHSA-2020:2362
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:2895, RHSA-2020:3084
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:2895, RHSA-2020:3084
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:2895, RHSA-2020:3084
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:2895, RHSA-2020:3084
Not affected: 4 products
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Openshift Container Storage 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7598
  2. 2026-10-03 Alias added: GHSA-vh95-rmgr-6w4m
  3. 2026-10-08 CISA SSVC decision points changed

References

Advisory 2

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences