Threats Tagged 'ghsa-xj6q-8x83-jv6g'

Axios versions from 1.15.2 up to but not including 1.18.0 contain a prototype pollution read-side vulnerability in Basic auth subfield handling. If an application using axios is already vulnerable to prototype pollution and makes a request with an auth object missing username or password properties, axios may inherit these values from Object.prototype and inject attacker-controlled Basic auth credentials into outbound requests. This can lead to outbound request tampering, including injection or replacement of Authorization headers, but does not directly disclose existing credentials. The vulnerability requires a separate prototype pollution primitive in the host application and specific axios usage patterns.