https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:58:28 +0000 https://vulnerability.circl.lu/vuln/ghsa-fvcv-3m26-pcqx <p><strong>Affected:</strong> npm: axios</p> <p># Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain</p> <p>## Summary The Axios library is vulnerable to a specific gadget-style attack chain in which **prototype pollution** in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.</p> <p>Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (`\r\n`) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.</p> <p>**Severity**: Moderate (CVSS 3.1 Base Score: 4.8) **Affected Versions**: All versions (v0.x - v1.x) **Vulnerable Component**: `lib/adapters/http.js` (Header Processing)</p> <p>## Usage of \&#34;Helper\&#34; Vulnerabilities This issue requires a separate **prototype pollution** vulnerability in another library in the application stack (for example, `qs`, `minimist`, `ini`, or `body-parser`). If an attacker can pollute `Object.prototype`, Axios may pick up the polluted properties during config merge.</p> <p>Because Axios does not sanitise these merged header values for CRLF (`\r\n`) characters, the polluted property can alter the structure of an outbound HTTP request.</p> <p>## Proof of Concept</p> <p>### 1. The Setup (Simulated Pollution) Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that…</p> <p><strong>Affected:</strong> npm: axios</p> <p># Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain</p> <p>## Summary The Axios library is vulnerable to a specific gadget-style attack chain in which **prototype pollution** in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.</p> <p>Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (`\r\n`) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.</p> <p>**Severity**: Moderate (CVSS 3.1 Base Score: 4.8) **Affected Versions**: All versions (v0.x - v1.x) **Vulnerable Component**: `lib/adapters/http.js` (Header Processing)</p> <p>## Usage of \&#34;Helper\&#34; Vulnerabilities This issue requires a separate **prototype pollution** vulnerability in another library in the application stack (for example, `qs`, `minimist`, `ini`, or `body-parser`). If an attacker can pollute `Object.prototype`, Axios may pick up the polluted properties during config merge.</p> <p>Because Axios does not sanitise these merged header values for CRLF (`\r\n`) characters, the polluted property can alter the structure of an outbound HTTP request.</p> <p>## Proof of Concept</p> <p>### 1. The Setup (Simulated Pollution) Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that…</p> https://vulnerability.circl.lu/vuln/ghsa-fvcv-3m26-pcqx