CVE-2021-44906: substack minimist
Vulnerability summary
CVE-2021-44906 is a critical (CVSS 9.8) vulnerability in substack minimist. EPSS estimates a 4.58% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities. 3 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 23 · Related 8Timeline
- 17-03-2022PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.58%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.58% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundJavascript Vulnerability Detection
Maturity: poc
Minimist
Maturity: poc
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard1 product
- scanner-test-npm-vulnerability-unfixedAll versions (No fix recorded)
Debian1 product
- node-minimist< 1.2.6+~cs5.3.2-1
Mageia1 product
- nodejs-minimist< 1.2.7-1.mga8
Npm1 product
- minimist≥ 1.0.0, < 1.2.6 | < 0.2.4
Substack1 product
- minimist< 1.2.6
Ubuntu1 product
- node-minimistAll versions (No fix recorded)
6 vendors · 6 products
References
23 links- github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zipREPORTWEBEVIDENCEExploitThird Party Advisory
- stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068REPORTWEBIssue TrackingThird Party Advisory
Show all 23 references
- github.com/substack/minimistPACKAGE