Prototype Pollution

Vulnerability

Overview

The linux-cmdline npm package versions prior to 1.0.1 are vulnerable to Prototype Pollution. The vulnerability resides in the package's argument-parsing logic, which recursively merges user-supplied command-line arguments into an internal object without sanitizing key properties such as __proto__ or constructor [1][2]. This allows an attacker to inject arbitrary properties into the Object prototype of the JavaScript runtime, affecting all objects in the application.

Attack

Vector and Prerequisites

To exploit this vulnerability, an attacker must be able to supply crafted command-line arguments to an application that uses the linux-cmdline parser. The attack does not require authentication if the application accepts user-controlled command-line input (e.g., through a cloud function, a build tool, or a config file parser). The parser, as shown in the commit fixing the issue [4], iterates over key paths and assigns values to nested objects without checking if properties like __proto__ are being overwritten in the prototype chain [3]. The dangerous code path allowed __proto__.polluted=foo to set {}.polluted globally [4].

Impact

Successful exploitation leads to Prototype Pollution, which can result in: - Denial of Service (DoS) by causing JavaScript exceptions when polluted properties trigger unexpected behavior. - Tampering of application logic, potentially leading to remote code execution (RCE) if the polluted property influences control flow or security checks [2].

Mitigation

The vulnerability was fixed in version 1.0.1 of linux-cmdline. The fix introduces proper key handling: the parser now checks for __proto__ at each nesting level and creates new objects only when necessary, preventing pollution of the global prototype [4]. Users should upgrade to 1.0.1 or later. There is no known workaround short of upgrading.