Read the docs
TI-2020-06130 Aliases CVE-2020-7608GHSA-p9pc-299p-vxgp

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Priority LOW 25CWE-1321Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-915.

Summary

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Why it matters now

EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed yargs-parser (npm): 13.1.2, 15.0.1, 18.1.1 +1Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—yargs-parserAll versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1—No fix listedCNA
—yargs-parser (npm)6.0.0 to before 13.1.213.1.2Patch availableGHSA-p9pc-299p-vxgp
—yargs-parser (npm)14.0.0 to before 15.0.115.0.1Patch availableGHSA-p9pc-299p-vxgp
—yargs-parser (npm)16.0.0 to before 18.1.118.1.1Patch availableGHSA-p9pc-299p-vxgp
—yargs-parser (npm)before 5.0.15.0.1Patch availableGHSA-p9pc-299p-vxgp
  • yargs-parser Vendor— Affected All versions prior to version 18.1.1 and patches at 13.1.2 and 15.0.1 Fixed in — No fix listed CNA
  • yargs-parser (npm) Vendor— Affected 6.0.0 to before 13.1.2 Fixed in 13.1.2 Patch available GHSA-p9pc-299p-vxgp
  • yargs-parser (npm) Vendor— Affected 14.0.0 to before 15.0.1 Fixed in 15.0.1 Patch available GHSA-p9pc-299p-vxgp
  • yargs-parser (npm) Vendor— Affected 16.0.0 to before 18.1.1 Fixed in 18.1.1 Patch available GHSA-p9pc-299p-vxgp
  • yargs-parser (npm) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-p9pc-299p-vxgp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:*before 5.0.1; 6.0.0 to before 13.1.2; 14.0.0 to before 15.0.1; 16.0.0 to before 18.1.1VulnerableYargs
  • cpe:2.3:a:yargs:yargs-parser:*:*:*:*:*:node.js:*:* Versions before 5.0.1; 6.0.0 to before 13.1.2; 14.0.0 to before 15.0.1; 16.0.0 to before 18.1.1 Vulnerable ·Yargs

Remediation

  • Fix · GHSA-p9pc-299p-vxgp yargs-parser (npm) Fixed in 13.1.2 Advisory →
  • Fix · GHSA-p9pc-299p-vxgp yargs-parser (npm) Fixed in 15.0.1 Advisory →
  • Fix · GHSA-p9pc-299p-vxgp yargs-parser (npm) Fixed in 18.1.1 Advisory →
  • Fix · GHSA-p9pc-299p-vxgp yargs-parser (npm) Fixed in 5.0.1 Advisory →

Red Hat 6 advisories

  • RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
    Red Hat Quay v3.6.0 security, bug fix and enhancement update
    • Quay v3 quay/quay-rhel8
  • RHSA-2021:2041 Released 2021-05-19 · Red Hat rating Moderate
    Red Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
    • Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator
  • RHSA-2021:0548 Released 2021-02-16 · Red Hat rating Moderate
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64::nodejs:10, nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le::nodejs:10, nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x::nodejs:10 +19
Show 3 more Red Hat advisories
  • RHSA-2021:0521 Released 2021-02-15 · Red Hat rating Moderate
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.23.1-2.el7, rh-nodejs10-nodejs-devel-10.23.1-2.el7, rh-nodejs10-nodejs-docs-10.23.1-2.el7 +1
  • RHSA-2020:5499 Released 2020-12-15 · Red Hat rating Moderate
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.aarch64::nodejs:12, nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.ppc64le::nodejs:12, nodejs-1:12.19.1-1.module+el8.3.0+8851+b7b41ca0.s390x::nodejs:12 +19
  • RHSA-2020:5305 Released 2020-12-01 · Red Hat rating Moderate
    rh-nodejs12-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.19.1-2.el7, rh-nodejs12-nodejs-devel-12.19.1-2.el7, rh-nodejs12-nodejs-docs-12.19.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.19.1-2.el7, rh-nodejs12-nodejs-devel-12.19.1-2.el7, rh-nodejs12-nodejs-docs-12.19.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.19.1-2.el7, rh-nodejs12-nodejs-devel-12.19.1-2.el7, rh-nodejs12-nodejs-docs-12.19.1-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.19.1-2.el7, rh-nodejs12-nodejs-devel-12.19.1-2.el7, rh-nodejs12-nodejs-docs-12.19.1-2.el7 +1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Quay v3Fixed RHSA-2021:3917
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:5499, RHSA-2021:0548
Red Hat OpenShift Container Storage 4.7 on RHEL-8Fixed RHSA-2021:2041
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5305, RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:5305, RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:5305, RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5305, RHSA-2021:0521
Not affected: 2 products
  • Quay v3
  • Red Hat OpenShift Container Storage 4.7 on RHEL-8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7608
  2. 2026-10-03 Alias added: GHSA-p9pc-299p-vxgp

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences