Search code examples
dependabotminimist

CVE-2021-44906 Prototype Pollution in minimist

Github dependabot found potential security vulnerabilities in My dependencies.

  • Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

I don't know how to fix it. What should I do?

Solution

  • Origin: https://github.com/substack/minimist/issues/164

    Fix Resolution: minimist - 1.2.6

    Install npm-force-resolutions:

    npx npm-force-resolutions

    then Add field resolutions with the dependency version you want to fix to your package.json file. It modifies package-lock.json to force the installation of a specific version of a transitive dependency.

    "resolutions": {
    "minimist": "1.2.6"
}