minimist (npm)

parse argument options

Advisories

Latest version

1.2.8

Released Feb 9, 2023

License

MIT

OpenSSF Scorecard

5.3 / 10

How to fix

Upgrading to 1.2.6 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install minimist@1.2.8

yarn

yarn add minimist@1.2.8

pnpm

pnpm add minimist@1.2.8

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-xvch-5gv4-984h Prototype Pollution in minimist	Critical EPSS 4.58%	`>= 1.0.0, < 1.2.6`	`1.2.6`
GHSA-xvch-5gv4-984h Prototype Pollution in minimist	Critical EPSS 4.58%	`< 0.2.4`	`0.2.4`
GHSA-vh95-rmgr-6w4m Prototype Pollution in minimist	Medium EPSS 1.93%	`< 0.2.1`	`0.2.1`
GHSA-vh95-rmgr-6w4m Prototype Pollution in minimist	Medium EPSS 1.93%	`>= 1.0.0, < 1.2.3`	`1.2.3`
GHSA-7fhm-mqm4-2wp7 Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution) Withdrawn	Medium	`< 1.2.2`	`1.2.2`

Source: git://github.com/minimistjs/minimist.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor