Threats tagged 'ghsa-6chq-wfr3-2hj9'

Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to a prototype pollution issue in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests. This occurs because Axios misidentifies any plain object payload as a FormData instance if Object.prototype is polluted with certain properties, leading to attacker-controlled headers being merged into requests. The vulnerability requires an existing prototype pollution primitive in the application's dependency chain and usage of Axios with a data payload. The issue can lead to authentication bypass, session fixation, privilege escalation, and IP spoofing or WAF bypass.