# yargs-parser@18.1.3 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:47:11.000Z
- Files reviewed: 2
- Findings: 1 medium, 2 low severity findings
- Report: https://security.togoder.click/npm/yargs-parser@18.1.3
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package yargs-parser@18.1.3 on Oct 4, 2026. An AI review of 2 source files produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Dynamic module loading with user-controlled path

Finding ID: `NPS-701F1BB4FFFC`

File: `index.js:578`

In setConfig(), the code calls require(resolvedConfigPath) where resolvedConfigPath is derived from CLI arguments or environment variables (configKey). This allows loading and executing arbitrary JavaScript files from any path on the filesystem, which could lead to arbitrary code execution if an attacker can control the config path argument or environment variables.

### [low] Function invocation from configuration

Finding ID: `NPS-C6AA170914CA`

File: `index.js:565`

flags.configs[configKey] may be a function supplied by the caller, which is invoked with the resolved config path. This is dynamic code execution controlled by the options object. While not malicious by itself, it enables execution of arbitrary functions if the parser is used with untrusted options.

### [low] Environment variable harvesting

Finding ID: `NPS-AA9418707A8A`

File: `index.js:616`

The applyEnvVars function iterates over all process.env entries and, when envPrefix is configured, reads environment variables and injects them into the parsed argv. This is intended behavior for a CLI parser, but it broadly reads all environment variables (including potentially sensitive ones) and makes them accessible via the returned argv object. If a consuming application uses this parser with an envPrefix and later logs or exposes argv, sensitive environment values could be leaked.

## Files reviewed

- `index.js` (medium): The yargs-parser code is a legitimate argument parser but contains a require() of a user-influenced config path, which could be abused for arbitrary code execution if config paths are attacker-controlled.
- `lib/tokenize-arg-string.js` (safe): Cleared by Jev triage; no further analysis needed

## Version ranges

None of the 3 scanned versions of yargs-parser are flagged high or critical. The latest scanned version, 22.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 22.0.0 (`22.0.0`): medium (Dynamic module loading with external input +1 more)
- 21.1.1 (`21.1.1`): not scanned
- 20.2.9 (`20.2.9`): medium (Dynamic module loading +1 more)
- 20.2.4 (`20.2.4`): not scanned
- 18.1.3 (`18.1.3`): medium (Dynamic module loading with user-controlled path)
- 5.0.1 (`5.0.1`): not scanned

## Scanned versions

- [22.0.0](https://security.togoder.click/npm/yargs-parser@22.0.0): medium, 2026-10-06T14:25:28.000Z
- [20.2.9](https://security.togoder.click/npm/yargs-parser@20.2.9): medium, 2026-10-06T14:14:52.000Z
- [18.1.3](https://security.togoder.click/npm/yargs-parser@18.1.3): medium, 2026-10-04T16:47:11.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology