https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:38:36 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10948 bdu:2026-10948 https://cve.radiocsirt.org/vuln/bdu:2026-10948 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-343843 EUVD-2026-343843 https://cve.radiocsirt.org/vuln/euvd-2026-343843 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67319 <p>axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process&#39;s Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.</p> <p>axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process&#39;s Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-67319 https://cve.radiocsirt.org/vuln/ghsa-7q8q-rj6j-mhjq <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.</p> <p>The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.</p> <p>## Impact</p> <p>This is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.</p> <p>Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.</p> <p>The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.</p> <p>This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.</p> <p>## Affected Functionality</p> <p>Affected runtime functionality:</p> <p>- Node HTTP adapter Basic auth handling in `lib/adap…</p> <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.</p> <p>The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.</p> <p>## Impact</p> <p>This is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.</p> <p>Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.</p> <p>The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.</p> <p>This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.</p> <p>## Affected Functionality</p> <p>Affected runtime functionality:</p> <p>- Node HTTP adapter Basic auth handling in `lib/adap…</p> https://cve.radiocsirt.org/vuln/ghsa-7q8q-rj6j-mhjq https://cve.radiocsirt.org/vuln/msrc_cve-2026-67319 msrc_CVE-2026-67319 https://cve.radiocsirt.org/vuln/msrc_cve-2026-67319 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 <p>agama-web-ui-24+0.a836cced5-52.1 on GA media</p> <p>agama-web-ui-24+0.a836cced5-52.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 https://cve.radiocsirt.org/vuln/rhsa-2026:49387 <p>fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority axios: axios: Information disclosure and data manipulation via prototype pollution</p> <p>fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority axios: axios: Information disclosure and data manipulation via prototype pollution</p> https://cve.radiocsirt.org/vuln/rhsa-2026:49387 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-67319 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process&#39;s Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process&#39;s Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-67319 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2958 <p>Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2958