Threats Tagged 'ghsa-xj6q-8x83-jv6g'

Axios versions from 1.15.2 up to but not including 1.18.0 contain a prototype pollution read-side vulnerability affecting Basic auth subfield handling. If an attacker can pollute Object.prototype with username or password properties and the host application makes an axios request with an auth object missing these own properties, axios will inherit and use the polluted values to construct the Authorization header. This can lead to outbound request tampering by injecting attacker-controlled Basic auth credentials or causing authorization failures. Exploitation requires a separate prototype pollution vulnerability in the host environment and specific axios usage patterns. The vulnerability does not directly leak credentials from axios itself. A fix is available for this issue.