GHSA-rwr8-xrpw-9qf5 solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets

• Packagist solspace/craft-freeform: < 4.1.22 → fixed in 4.1.22 • Packagist solspace/craft-freeform: >= 5.0.0-beta.1, < 5.5.9 → fixed in 5.5.9

Summary The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios Details We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.