CVE-2020-7608

5.3

MEDIUM

Yargs-Parser Prototype Pollution Vulnerability

Description

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

INFO

Published Date :

March 16, 2020, 8:15 p.m.

Last Modified :

Nov. 21, 2024, 5:37 a.m.

Source :

[email protected]

Remotely Exploitable :

No

Impact Score :

3.4

Exploitability Score :

1.8 Public PoC/Exploit Available at Github

CVE-2020-7608 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2020-7608 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Yargs	yargs-parser

: Total Affected Vendor : 1 | Products : 1

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2020-7608.

URL	Resource
https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381	Exploit Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381	Exploit Patch Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

arsalan-learn/pnpm_test

None

JavaScript

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : April 4, 2025, 2:33 p.m. This repo has been linked 4 different CVEs too.

rahg0/vuln-node-app-pnpm

Packages added via pnpm package manager

JavaScript

Updated: 3 months ago

1 stars 0 fork 0 watcher

Born at : Jan. 25, 2025, 3:38 p.m. This repo has been linked 2 different CVEs too.

rahg0/vuln-node-app-yarn

Packages added via yarn package manager

JavaScript

Updated: 3 months ago

1 stars 0 fork 0 watcher

Born at : Jan. 25, 2025, 12:13 p.m. This repo has been linked 2 different CVEs too.

rahg0/vuln-node-app

Vulnerabilities introduced via older version of bestzip package

JavaScript

Updated: 3 months ago

1 stars 1 fork 1 watcher

Born at : Jan. 23, 2025, 7:27 a.m. This repo has been linked 2 different CVEs too.

seal-community/patches

A centralized repository of standalone security patches for open source libraries.

appsec backport cve devsecops fix hotfix open-source patch protection remediation seal security update upgrade vulnerability

Updated: 10 months ago

182 stars 0 fork 0 watcher

Born at : July 30, 2023, 4:46 p.m. This repo has been linked 265 different CVEs too.

MaySoMusician/geidai-ikoi

None

JavaScript Vue TypeScript SCSS CSS

Updated: 3 years, 5 months ago

0 stars 0 fork 0 watcher

Born at : May 2, 2021, 4:50 p.m. This repo has been linked 22 different CVEs too.

Kirill89/Kirill89

None

Updated: 6 months ago

3 stars 0 fork 0 watcher

Born at : Dec. 10, 2020, 10:39 a.m. This repo has been linked 20 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2020-7608 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2020-7608 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Modified by af854a3a-2127-422b-91ae-364da2661108

Nov. 21, 2024

Action	Type	Old Value	New Value
Added	Reference		https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

CVE Modified by [email protected]

May. 14, 2024

Action	Type	Old Value	New Value

Reanalysis by [email protected]

Nov. 15, 2022

Action	Type	Old Value	New Value
Removed	CWE	NIST CWE-915
Added	CWE		NIST CWE-1321
Changed	CPE Configuration	OR cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions up to (excluding) 13.1.2 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 14.0.0 up to (excluding) 15.0.1 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 16.0.0 up to (excluding) 18.1.1	OR cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions up to (excluding) 5.0.1 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 6.0.0 up to (excluding) 13.1.2 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 14.0.0 up to (excluding) 15.0.1 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 16.0.0 up to (excluding) 18.1.1

CWE Remap by [email protected]

Jul. 21, 2021

Action	Type	Old Value	New Value
Changed	CWE	CWE-20	CWE-915

Reanalysis by [email protected]

Jun. 05, 2020

Action	Type	Old Value	New Value
Removed	CVSS V2	NIST (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Added	CVSS V2		NIST (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Removed	CVSS V3.1	NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Initial Analysis by [email protected]

Mar. 19, 2020

Action	Type	Old Value	New Value
Added	CVSS V2		NIST (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Changed	Reference Type	https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381 No Types Assigned	https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381 Exploit, Patch, Third Party Advisory
Added	CWE		NIST CWE-20
Added	CPE Configuration		OR cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions up to (excluding) 13.1.2 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 14.0.0 up to (excluding) 15.0.1 cpe:2.3:a:yargs:yargs-parser::::::node.js:: versions from (including) 16.0.0 up to (excluding) 18.1.1

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2020-7608 is associated with the following CWEs:

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2020-7608 weaknesses.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels Exploiting Incorrectly Configured Access Control Security Levels

CVE-2020-7608

Yargs-Parser Prototype Pollution Vulnerability

Description

INFO

March 16, 2020, 8:15 p.m.

Nov. 21, 2024, 5:37 a.m.

No

3.4

1.8

Public PoC/Exploit Available at Github

Affected Products

References to Advisories, Solutions, and Tools

CVE Modified by af854a3a-2127-422b-91ae-364da2661108

CVE Modified by [email protected]

Reanalysis by [email protected]

CWE Remap by [email protected]

Reanalysis by [email protected]

Initial Analysis by [email protected]

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit Prediction

0.11 }} 0.07%

0.30759

CVSS31 - Vulnerability Scoring System

Theme Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable