CVE-2020-7608: Yargs Yargs-Parser

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Affected products

• Yargs Yargs-Parser: before 5.0.1 (fixed in 5.0.1); from 6.0.0, before 13.1.2 (fixed in 13.1.2); from 14.0.0, before 15.0.1 (fixed in 15.0.1); from 16.0.0, before 18.1.1 (fixed in 18.1.1)

Published 2020-03-16. Last modified 2026-06-17.