CVEvulnerability

CVE-2026-44495

7.7 HIGH Published 2026-06-11 Modified 2026-09-11 Official page ↗
Status
Modified
Published
2026-06-11
Last modified
2026-09-11
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-1321, CWE-915, CWE-94

Description

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

Affected configurations

• axios axios (>= 0.19.0 < 0.31.1) • axios axios (>= 1.0.0 < 1.15.2) • redhat advanced cluster management for kubernetes (< 2.13.9) • redhat advanced cluster security (< 4.10.3) • redhat ansible automation platform 2.6 • redhat data grid 8.6.2 • redhat developer hub • redhat discovery • redhat openshift container platform • redhat openshift dev spaces • redhat openshift service mesh • redhat openshift virtualization • redhat quay

Related

Weakness · CWE (3)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness
  • CWE-94 Improper Control of Generation of Code weakness

References