Към съдържанието
Търсене

CVE-2026-44494: axios, инжекция

8.7

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.

Засегнати продукти

  • axios axios: >= 1.0.0, < 1.16.0
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8: 0:2.5.20260715-1.el8ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9: 0:2.5.20260715-1.el9ap преди *
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat multicluster engine for Kubernetes 2.1: 1784312384 преди *
  • Red Hat multicluster engine for Kubernetes 2.6: 1783351002 преди *
  • Red Hat multicluster engine for Kubernetes 2.8: 1782157085 преди *
  • Red Hat multicluster engine for Kubernetes 2.9: 1783348181 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11: 1783350952 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13: 1782157514 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14: 1783451729 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15: 1784578812 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16: 1786908361 преди *
  • Red Hat Red Hat Advanced Cluster Security 4.9: 1779371594 преди *
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10: 1779293013 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.7: 1783919486 преди *
  • Red Hat Red Hat Container Native Virtualization 4.13: 1782426816 преди *
  • Red Hat Red Hat Container Native Virtualization 4.14: 1782356760 преди *
  • Red Hat Red Hat Developer Hub 1.10: 1783448184 преди *
  • Red Hat Red Hat Developer Hub 1.9: 1782761244 преди *
  • Red Hat Red Hat Discovery 2: 1782166952 преди *
  • Red Hat Red Hat Migration Toolkit 1.8: 1783690532 преди *
  • Red Hat Red Hat Migration Toolkit for Applications 8.1: 1785169013 преди *
  • Red Hat Red Hat OpenShift AI 3.4: 1787347991 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.13: 1786477760 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.14: 1782911957 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.15: 1782127091 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.16: 1782244020 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.19: 1782171032 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.20: 1782313844 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.21: 1781731914 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.22: 1782913451 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.29: 1782498475 преди *
  • Red Hat Red Hat OpenShift Service Mesh 2.6: 1781937133 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.0: 1782201894 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.1: 1782201696 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.2: 1782201851 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.3: 1782231869 преди *
  • Red Hat Red Hat Quay 3.10: 1783750447 преди *
  • Red Hat Red Hat Quay 3.12: 1783751865 преди *; 1784353904 преди *
  • Red Hat Red Hat Quay 3.15: 1784351966 преди *
  • Red Hat Red Hat Quay 3.16: 1783955846 преди *
  • Red Hat Red Hat Quay 3.9: 1784125838 преди *
  • Red Hat Red Hat Satellite 6.19: 1781174698 преди *
  • Red Hat Red Hat Trusted Artifact Signer 1.3: 1784105894 преди *
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Network Observability Operator
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Trusted Profile Analyzer
  • Red Hat Self-service automation portal 2

Вид слабост

История

  • 11 юни 2026 Публикувано

Други уязвимости в axios axios

Първоизточници

CVE-2026-44494: axios, инжекция | freedomonline.bg