Threats tagged 'ghsa-w9j2-pvgh-6h63'

Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to a prototype pollution attack that allows an attacker to bypass authentication by causing all HTTP error responses to be treated as successful. This occurs due to the use of the 'in' operator in the 'validateStatus' merge strategy, which traverses the prototype chain and can inherit a polluted 'validateStatus' function returning true. This vulnerability enables silent suppression of HTTP error codes such as 401, 403, and 500, leading to unauthorized access and bypass of application-level error handling.