CVE-2021-44906 Prototype Pollution in minimist

Question

Github dependabot found potential security vulnerabilities in My dependencies.

• Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

I don't know how to fix it. What should I do?

Answer 1

Origin: https://github.com/substack/minimist/issues/164

Fix Resolution: minimist - 1.2.6

Install npm-force-resolutions:

npx npm-force-resolutions

then Add field resolutions with the dependency version you want to fix to your package.json file. It modifies package-lock.json to force the installation of a specific version of a transitive dependency.

"resolutions": {
    "minimist": "1.2.6"
}