AIKIDO-2023-10001
axios is vulnerable to Prototype Pollution
77
High Risk
This Affects:
axiosTL;DR
Several security vulnerabilities were quietly patched in axios version 1.6.4 and version 0.29.0. Notably, a prototype pollution flaw impacted the formDataToJSON function, posing a significant risk. Additionally, a Regular Expression Denial of Service (ReDoS) vulnerability was identified and fixed in the combineURLs function.
Who does this affect?
You are affected by this flaw if you use the formDataToJSON function. This is more likely to happen in a front-end than in a backend.
Background info
axios is vulnerable to Prototype Pollution in versions 0.1.0 - 0.28.1 and 1.0.0 - 1.6.3.
How to fix this
To fix, either freeze the prototype or upgrade to axios 1.6.4 or above.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant