Vulnerability in "minimist" found in package-lock.json

[schubon]

Details

CVE-2020-7598

high severity
Vulnerable versions: < 0.2.1
Patched version: 0.2.1

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Remediation

Upgrade minimist to version 0.2.1 or later. For example:

"dependencies": {
  "minimist": ">=0.2.1"
}

or…

"devDependencies": {
  "minimist": ">=0.2.1"
}

Always verify the validity and compatibility of suggestions with your codebase.