Threats tagged 'ghsa-pf86-5x62-jrwf'

Axios versions from 1.0.0 up to 1.15.0 and versions below 0.31.1 are vulnerable to prototype pollution gadgets that allow attackers to tamper with JSON responses and hijack HTTP requests. This occurs when Object.prototype is polluted by a co-dependency, enabling attackers to intercept and modify JSON responses or hijack HTTP transport to access request credentials and data. The vulnerability arises because axios merges configuration objects without guarding against inherited properties, allowing polluted prototype properties to influence behavior such as JSON parsing via a malicious parseReviver function. A fix is available in versions 1.15.1 and 0.31.1.