https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:15:31 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/euvd-2026-326689 EUVD-2026-326689 https://cve.radiocsirt.org/vuln/euvd-2026-326689 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44489 <p>Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.</p> <p>Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44489 https://cve.radiocsirt.org/vuln/ghsa-654m-c8p4-x5fp <p><strong>Affected:</strong> npm: axios</p> <p># [Patch Bypass] Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix in Axios 1.15.2</p> <p>## Summary</p> <p>The `Object.create(null)` fix introduced in Axios 1.15.2 (GHSA-q8qp-cvcw-x6jj) protects the **top-level config object** from prototype pollution. However, **nested objects** created by `utils.merge()` (e.g., `config.proxy`) are still constructed as plain `{}` with `Object.prototype` in their chain.</p> <p>The `setProxy()` function at `lib/adapters/http.js:209-223` reads `proxy.username`, `proxy.password`, and `proxy.auth` **without `hasOwnProperty` checks**. When `Object.prototype.username` is polluted, `setProxy()` constructs a `Proxy-Authorization` header with attacker-controlled credentials and injects it into **every proxied HTTP request**.</p> <p>**Severity:** Medium (CVSS 5.4) **Affected Versions:** 1.15.2 (and potentially 1.15.1) **Vulnerable Component:** `lib/adapters/http.js` (`setProxy()`) + `lib/utils.js` (`merge()`)</p> <p>## CWE</p> <p>- **CWE-1321:** Improperly Controlled Modification of Object Prototype Attributes (&#39;Prototype Pollution&#39;) - **CWE-113:** Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;)</p> <p>## CVSS 3.1</p> <p>**Score: 5.6 (Medium)**</p> <p>Vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L`</p> <p>| Metric | Value | Justification | |---|---|---| | Attack Vector | Network | PP triggered remotely via vulnerable dependency | | Attack Complexity | **High** | Requires **two** preconditions: (1) PP in dependency tree, AN…</p> <p><strong>Affected:</strong> npm: axios</p> <p># [Patch Bypass] Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix in Axios 1.15.2</p> <p>## Summary</p> <p>The `Object.create(null)` fix introduced in Axios 1.15.2 (GHSA-q8qp-cvcw-x6jj) protects the **top-level config object** from prototype pollution. However, **nested objects** created by `utils.merge()` (e.g., `config.proxy`) are still constructed as plain `{}` with `Object.prototype` in their chain.</p> <p>The `setProxy()` function at `lib/adapters/http.js:209-223` reads `proxy.username`, `proxy.password`, and `proxy.auth` **without `hasOwnProperty` checks**. When `Object.prototype.username` is polluted, `setProxy()` constructs a `Proxy-Authorization` header with attacker-controlled credentials and injects it into **every proxied HTTP request**.</p> <p>**Severity:** Medium (CVSS 5.4) **Affected Versions:** 1.15.2 (and potentially 1.15.1) **Vulnerable Component:** `lib/adapters/http.js` (`setProxy()`) + `lib/utils.js` (`merge()`)</p> <p>## CWE</p> <p>- **CWE-1321:** Improperly Controlled Modification of Object Prototype Attributes (&#39;Prototype Pollution&#39;) - **CWE-113:** Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;)</p> <p>## CVSS 3.1</p> <p>**Score: 5.6 (Medium)**</p> <p>Vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L`</p> <p>| Metric | Value | Justification | |---|---|---| | Attack Vector | Network | PP triggered remotely via vulnerable dependency | | Attack Complexity | **High** | Requires **two** preconditions: (1) PP in dependency tree, AN…</p> https://cve.radiocsirt.org/vuln/ghsa-654m-c8p4-x5fp https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44489 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44489 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3307 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ Appliance ausnutzen, um beliebigen Programmcode auszuführen, Server-Side Request Forgery (SSRF) durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ Appliance ausnutzen, um beliebigen Programmcode auszuführen, Server-Side Request Forgery (SSRF) durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3307