minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2020-7598 · Microsoft / collected KEV context

EUVD-2020-0395

GHSA-vh95-rmgr-6w4m

cve-program · CVE-2020-7598

• https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

euvd · EUVD-2020-0395

• https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

nvd · CVE-2020-7598

• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html
• https://snyk.io/vuln/SNYK-JS-MINIMIST-559764

osv · GHSA-vh95-rmgr-6w4m

• https://nvd.nist.gov/vuln/detail/CVE-2020-7598
• https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68
• https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab
• https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95
• https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94
• https://github.com/substack/minimist
• https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
• https://www.npmjs.com/advisories/1179
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

No related operational record is retained in the current change model.