Prototype pollution in axios - #VU127592

Detailed vulnerability description

The vulnerability allows a remote attacker to inject credentials and hijack requests.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the HTTP adapter when reading configuration properties via direct property access from polluted prototypes. A remote attacker can pollute Object.prototype through another dependency in the same process to inject credentials and hijack requests.

Exploitation requires prototype pollution by another dependency in the same process, and requests using relative URLs can be redirected to an attacker-controlled server.

Remediation

Sources

• https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj