ID:12753 - Exploit for Prototype pollution in axios - CVE-2026-44494

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in config.proxy. A remote attacker can pass specially crafted input to the application and perform a man-in-the-middle (MitM) attack, which can result in information disclosure or data manipulation.

Remediation