CVE-2026-44495— Axios 代码注入漏洞

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

对生成代码的控制不恰当(代码注入)

Axios 代码注入漏洞

Axios是Axios开源的一款基于Promise（异步编程的一种解决方案）的HTTP客户端。 Axios 0.19.0至0.31.1之前版本和1.15.2之前版本存在代码注入漏洞，该漏洞源于请求配置处理中存在原型污染小工具，可能导致已污染的Object.prototype.transformResponse被当作请求配置或选项验证器。

N/A

N/A