yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

https://nvd.nist.gov/vuln/detail/CVE-2020-7608

Can we please include the patched version of the dependency 