Threats tagged 'ghsa-xx6v-rp6x-q39c'

Axios contains a vulnerability in its XSRF token protection logic where the `withXSRFToken` configuration property is coerced using JavaScript truthy/falsy semantics rather than strict boolean checks. This flaw allows prototype pollution or misconfiguration to cause the same-origin check to be bypassed, resulting in XSRF tokens being sent to cross-origin servers, potentially controlled by attackers. The vulnerability affects all Axios versions from 1.0.0 up to but not including 1.15.1, and all versions before 0.31.1. It is limited to browser environments and enables theft of anti-CSRF tokens, which can facilitate CSRF attacks but does not directly compromise session tokens. A fix is available in versions 1.15.1 and 0.31.1.