CRITICAL9.8

GHSA-2c29-wc65-4cx9

linux-cmdline is vulnerable to Prototype Pollution via the constructor

Quick fix

GHSA-2c29-wc65-4cx9 — linux-cmdline: upgrade to the fixed version with the command below.

npm install linux-cmdline@1.0.1

Details

The package linux-cmdline is a parser for Linux kernel command line arguments. Versions before 1.0.1 are vulnerable to Prototype Pollution via the constructor.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/linux-cmdline

Introduced in: 0Fixed in: 1.0.1

Fixnpm install linux-cmdline@1.0.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7704[ADVISORY]
https://github.com/piranna/linux-cmdline/commit/53c61a88bc47eb25d71832205056beaab95cf677[WEB]
https://github.com/piranna/linux-cmdline[PACKAGE]
https://snyk.io/vuln/SNYK-JS-LINUXCMDLINE-598674[WEB]