Threats tagged 'ghsa-3w6x-2g7m-8v23'

Axios versions from 1.0.0 up to but not including 1.15.2 are vulnerable to a critical prototype pollution gadget in the parseReviver function used during JSON response parsing. This vulnerability allows an attacker who can pollute Object.prototype in the application's dependency tree to invisibly and selectively modify JSON API responses, enabling privilege escalation, balance manipulation, and authorization bypass without altering the overall response structure. The flaw arises because parseReviver is not validated or constrained and is called for every key-value pair in JSON responses. A fix is available in version 1.15.2.