https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:14:51 +0000 https://db.gcve.eu/vuln/ghsa-7q8q-rj6j-mhjq <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.</p> <p>The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.</p> <p>## Impact</p> <p>This is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.</p> <p>Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.</p> <p>The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.</p> <p>This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.</p> <p>## Affected Functionality</p> <p>Affected runtime functionality:</p> <p>- Node HTTP adapter Basic auth handling in `lib/adap…</p> <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.</p> <p>The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.</p> <p>## Impact</p> <p>This is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.</p> <p>Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.</p> <p>The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.</p> <p>This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.</p> <p>## Affected Functionality</p> <p>Affected runtime functionality:</p> <p>- Node HTTP adapter Basic auth handling in `lib/adap…</p> https://db.gcve.eu/vuln/ghsa-7q8q-rj6j-mhjq