https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:31:01 +0000 https://db.gcve.eu/vuln/ghsa-3w6x-2g7m-8v23 <p><strong>Affected:</strong> npm: axios</p> <p># Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`</p> <p>## Summary</p> <p>The Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any `Object.prototype` pollution in the application&#39;s dependency tree to be escalated into **surgical, invisible modification of all JSON API responses** — including privilege escalation, balance manipulation, and authorization bypass.</p> <p>The default `transformResponse` function at `lib/defaults/index.js:124` calls `JSON.parse(data, this.parseReviver)`, where `this` is the merged config object. Because `parseReviver` is **not present in Axios defaults, not validated by `assertOptions`, and not subject to any constraints**, a polluted `Object.prototype.parseReviver` function is called for **every key-value pair** in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.</p> <p>This is **strictly more powerful** than the `transformResponse` gadget because: 1. **No constraints** — the reviver can return any value (no &#34;must return true&#34; requirement) 2. **Selective modification** — individual JSON keys can be changed while others remain untouched 3. **Invisible** — the response structure and most values look completely normal 4. **Simultaneous exfiltration** — the reviver sees the original values before modification</p> <p>**Severity:** Critical (CVSS 9.1) **Affected Versions:** All versions (v0.x - v1.x including…</p> <p><strong>Affected:</strong> npm: axios</p> <p># Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`</p> <p>## Summary</p> <p>The Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any `Object.prototype` pollution in the application&#39;s dependency tree to be escalated into **surgical, invisible modification of all JSON API responses** — including privilege escalation, balance manipulation, and authorization bypass.</p> <p>The default `transformResponse` function at `lib/defaults/index.js:124` calls `JSON.parse(data, this.parseReviver)`, where `this` is the merged config object. Because `parseReviver` is **not present in Axios defaults, not validated by `assertOptions`, and not subject to any constraints**, a polluted `Object.prototype.parseReviver` function is called for **every key-value pair** in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.</p> <p>This is **strictly more powerful** than the `transformResponse` gadget because: 1. **No constraints** — the reviver can return any value (no &#34;must return true&#34; requirement) 2. **Selective modification** — individual JSON keys can be changed while others remain untouched 3. **Invisible** — the response structure and most values look completely normal 4. **Simultaneous exfiltration** — the reviver sees the original values before modification</p> <p>**Severity:** Critical (CVSS 9.1) **Affected Versions:** All versions (v0.x - v1.x including…</p> https://db.gcve.eu/vuln/ghsa-3w6x-2g7m-8v23