{"id":"CVE-2021-44906","title":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","summary":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-1321"],"vendor":"substack","product":"minimist","affected":["minimist < 1.2.6"],"patched":["minimist 1.2.6"],"published":"2022-03-17","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:42.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","references":[{"url":"https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","label":"cve@mitre.org"},{"url":"https://github.com/substack/minimist/blob/master/index.js#L69","label":"cve@mitre.org"},{"url":"https://github.com/substack/minimist/issues/164","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","label":"cve@mitre.org"},{"url":"https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","label":"cve@mitre.org"},{"url":"https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","label":"cve@mitre.org"},{"url":"https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/substack/minimist/blob/master/index.js#L69","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/substack/minimist/issues/164","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.04581,"epssPercentile":0.91383,"exploits":{"github":1,"githubRepos":["https://github.com/nevermoe/CVE-2021-44906"],"checkedAt":"2026-10-08T22:12:30.003Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T22:11:53.748Z","slug":"CVE-2021-44906","body":"## Overview\n\nMinimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).\n\n## Affected\n\n- `minimist < 1.2.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `minimist 1.2.6`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":53.9,"likelihood":0.9,"exploitation":12,"ransomware":0},"changes":[]}