CVE-2021-44906 Prototype Pollution in minimist

Question

Github dependabot found potential security vulnerabilities in My dependencies.

• Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

I don't know how to fix it. What should I do?

Turnover

Answer 1

Origin: https://github.com/substack/minimist/issues/164

Fix Resolution: minimist - 1.2.6

Install npm-force-resolutions:

npx npm-force-resolutions

then Add field resolutions with the dependency version you want to fix to your package.json file. It modifies package-lock.json to force the installation of a specific version of a transitive dependency.

"resolutions": {
    "minimist": "1.2.6"
}

Indican

origin: github.com/substack/minimist/issues/164 – Indican

I had to run npx npm-force-resolutions after modifying package.json – Sanjak

You can find some more background information on this here - what are resolutions and why do you need them? – Parapsychology

See also here: minimist-vulnerability – Parapsychology