What is CVE-2020-7598?

CVE-2020-7598 is a medium-severity vulnerability in Substack Minimist, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 5.6/10. Published 2020-03-11.

How severe is CVE-2020-7598?

Medium severity. CVSS v3 base score is 5.6 out of 10.

Is CVE-2020-7598 known to be exploited?

22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Prototype Pollution in Substack Minimist

CVE-2020-7598

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

Vulnerability class: Prototype Pollution

EPSS: 0.019 (76.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Substack Minimist
Opensuse Leap — versions 15.1
N/a Minimist — versions All versions prior to version 1.2.2

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Public proof-of-concept exploits

References

report@snyk.io (Exploit, Patch, Third Party Advisory, x_refsource_MISC)
report@snyk.io (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)

Frequently asked questions

What is CVE-2020-7598?: CVE-2020-7598 is a medium-severity vulnerability in Substack Minimist, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 5.6/10. Published 2020-03-11.
How severe is CVE-2020-7598?: Medium severity. CVSS v3 base score is 5.6 out of 10.
Is CVE-2020-7598 known to be exploited?: 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.