{"id":"EUVD-2026-25607","enisaUuid":"65e90378-d141-310f-9aff-e190b84337ed","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library\u0027s XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.","datePublished":"Apr 24, 2026, 6:03:29 PM","dateUpdated":"Apr 27, 2026, 5:35:41 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c\n","aliases":"CVE-2026-42042\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"4a3c6cd7-b6bc-3d4a-8076-58b978b32959","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"\u003c 0.31.1"},{"id":"e7cb7e5a-d0f0-3332-900b-da3c2e7a4e4c","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"1.0.0, \u003c 1.15.1"}],"enisaIdVendor":[{"id":"d106cf89-8751-3122-b0d9-546ec75d4b59","vendor":{"name":"axios"}}],"enisaIdVulnerability":[{"id":"4eecaee4-90cd-3375-a7c5-2d335a2ada17","vulnerability":{"id":"GHSA-xx6v-rp6x-q39c","description":"Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion","datePublished":"May 5, 2026, 12:25:22 AM","dateUpdated":"May 5, 2026, 12:25:22 AM","baseScore":0.0,"references":"https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42042\nhttps://github.com/axios/axios\n","enisa_id":"EUVD-2026-25607\n","aliases":"CVE-2026-42042\nGHSA-xx6v-rp6x-q39c\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:47:46 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"53f2befe-ced2-37e1-95e3-d6b75f30c088","vulnerability":{"id":"CVE-2026-42042","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library\u0027s XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.","datePublished":"Apr 24, 2026, 6:03:29 PM","dateUpdated":"Apr 27, 2026, 5:35:41 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c\n","enisa_id":"EUVD-2026-25607\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 13, 2026, 7:21:38 AM","vulnerabilityProduct":[{"id":"9c354a3d-c83e-3752-9651-e23edd880a8a","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"1.0.0, \u003c 1.15.1"},{"id":"f0b16939-236e-312a-95bc-4992a695f2be","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"\u003c 0.31.1"}],"vulnerabilityVendor":[{"id":"c5c48ea4-2f7f-3628-9194-2e82cc73484b","vendor":{"name":"axios"}}]}}],"enisaIdAdvisory":[{"id":"b3fa7cf1-f68c-3a17-be2c-e3d5509a045f","advisory":{"id":"RHSA-2026:86618","description":"Red Hat Security Advisory: New container image: rhceph-9.2","summary":"A new version of Red Hat build of Ceph Storage has been released","datePublished":"Oct 21, 2026, 6:15:17 AM","dateUpdated":"Nov 13, 2026, 2:59:10 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:86618\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86618.json\n","aliases":"CVE-2023-46159\nCVE-2024-47866\nCVE-2024-48916\nCVE-2024-55565\nCVE-2025-12816\nCVE-2025-15599\nCVE-2025-26791\nCVE-2025-30156\nCVE-2025-50181\nCVE-2025-50182\nCVE-2025-58754\nCVE-2025-59343\nCVE-2025-62718\nCVE-2025-66030\nCVE-2025-66035\nCVE-2025-66412\nCVE-2025-69873\nCVE-2026-0540\nCVE-2026-21441\nCVE-2026-22610\nCVE-2026-25639\nCVE-2026-26996\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-27970\nCVE-2026-32141\nCVE-2026-33228\nCVE-2026-33671\nCVE-2026-33672\nCVE-2026-33891\nCVE-2026-33894\nCVE-2026-33895\nCVE-2026-33896\nCVE-2026-39865\nCVE-2026-40175\nCVE-2026-40895\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-42033\nCVE-2026-42034\nCVE-2026-42035\nCVE-2026-42036\nCVE-2026-42037\nCVE-2026-42038\nCVE-2026-42039\nCVE-2026-42040\nCVE-2026-42041\nCVE-2026-42042\nCVE-2026-42043\nCVE-2026-42044\nCVE-2026-50152\nCVE-2026-58224\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"00235f61-fab3-373e-9125-2bd4e74dbcdb","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:c44c3c02709d9effcee15e4c444d0933e4dc92200126256bc436a91315d661ce_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"05543bef-eb90-3d61-ad9a-f8d5513a0b36","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:215b4d293664a13186f738a02307ad686ecd8c18e3154778cefc5cd48098244a_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"062e9634-92cb-3ab0-813b-21574fb4b222","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:8cffd72b960f38ac68d645e4a9bebefb41ea6ec86f6eade0e31e94e54eff9518_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"115b2121-e505-3a07-8517-7ca8204a71cf","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:418bfcb3127da79a33297b2d48718b1de233c833fe9e4f0bf135974d254ad417_s390x","vendor":{"name":"Red Hat"}}},{"id":"165ad424-0b0d-3b4d-99cc-752b12ee94bd","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:d5ecc8340af5598131845db29148b24b4a6da344ae9831c7ffd10a2847000208_arm64","vendor":{"name":"Red Hat"}}},{"id":"17ce7fc8-8921-363d-b5c1-faf2eec970da","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:6028e75c091f45e699c18817ab387fc267566c3a99f35cbc16dd6678eca52b04_amd64","vendor":{"name":"Red Hat"}}},{"id":"1a6b6f51-8d08-3e05-8e38-47276b79c008","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:f1b9bb921dd0c71c7c30b5880e9d15ac1f11be1fa1d6fccd8a4728a4df2369be_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"220e7b29-d390-3d75-82bb-e7eed61339c2","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:41eb459a0560110c950039d3ea5b34e235d05a06dd4c2f2da7ef14fecc641bdc_s390x","vendor":{"name":"Red Hat"}}},{"id":"27a3978e-81d7-3392-b333-816ecc8ee455","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:7ffce56beb357c70924100d89b078786229036577b3fc5682fc9ffe937f9d011_arm64","vendor":{"name":"Red Hat"}}},{"id":"2a593e22-dad7-3a4b-b3c2-c381ec0f2383","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:6f01015230f5c2ae3d75b9f0cae11538235e617a22d036dea04f6371769c1299_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"336c104d-be0c-3a71-930f-9796a0f04bbd","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:2dd73def241db73d57cdac5cfc8f7e9b32728de0b86007dd28a4a33d91680d4d_s390x","vendor":{"name":"Red Hat"}}},{"id":"58c6780b-ade4-36aa-a3ef-d85ccf48d54b","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:ad80f5f61a2f2c3bb39c4d787fba18dc3a3d99ac688b07110b946ff3c8c31bc4_s390x","vendor":{"name":"Red Hat"}}},{"id":"59fad50d-49dc-3744-a47b-9eb61e630ce0","product":{"name":"Red Hat Ceph Storage 9.2","vendor":{"name":"Red Hat"}}},{"id":"62c7aa0c-f798-3715-973a-40fe1f782ed6","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel10@sha256:bde0c68d5c31070466d8708b1e5cdf94587d1a01464ec03d40ebf30f5c7e1b11_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"66c41e54-1020-344f-8ed5-599bf0762a5d","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:bf7e7d9293a49520e6c07b6627cc1165b59d40b92ee15010a82735f8c4443602_s390x","vendor":{"name":"Red Hat"}}},{"id":"67841d07-eb9f-3506-958e-3b1f7e65328e","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:e5a4422325d975bb20f0ab152279748f6b33ec6b87d6419418917ab25c889e4a_s390x","vendor":{"name":"Red Hat"}}},{"id":"6d6d1116-3b1d-3465-a774-ba53fe216067","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:e1cbac58bcf8b551d5ea1b47f94798dcc632d81b38908f462e7d3e91771f60a4_amd64","vendor":{"name":"Red Hat"}}},{"id":"6f111f08-1aa3-3911-881d-eed311ef26e7","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:97d8626437b17428366dccb70fc7d8eb22840623b164b491cceb66de07bc2279_amd64","vendor":{"name":"Red Hat"}}},{"id":"71a5f7d7-9409-3116-a47e-45c8f57bc452","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:3bf292a7d44614e5be829d1f3a4daeb2873405bd0886d0802bd32a9aacf6f781_amd64","vendor":{"name":"Red Hat"}}},{"id":"74fbadd0-686a-3d87-b51c-a6ccfda5d94a","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:6e1f39f8225811070c27db40eba93cc567d44d43184ca10b317abad99ee0b485_amd64","vendor":{"name":"Red Hat"}}},{"id":"83b3d452-12df-31b3-8a55-e5156f200f05","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:4ea52cbdb1c42b970667045f794a8ad75d8d9df236a2d0e4751519a2c0904b87_amd64","vendor":{"name":"Red Hat"}}},{"id":"8baaf5e8-d54a-3d3b-aa04-426d1126dfa8","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:8401aa351c60cbb096283b1efaefa0b44012a9487fbee8c8342b77bbdbfb6111_arm64","vendor":{"name":"Red Hat"}}},{"id":"95b65ad3-92d0-3fd8-8042-e1deb59c860b","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:dbaea4a6d152c0a28f467dfc77b01d25aeebc0d0b7bb159c991771ff4a680c0d_s390x","vendor":{"name":"Red Hat"}}},{"id":"96f6f7f8-03b0-323c-acd4-80e54cfeabc0","product":{"name":"registry.redhat.io/rhceph/rhceph-9-rhel10@sha256:d6d5f168fb70e819659cdc47a64483b6509f3858b36df465e9c44533ab4af56c_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"9f6b1502-4ee6-307d-b75f-03ffca4756b5","product":{"name":"registry.redhat.io/rhceph/alloy-rhel10@sha256:b8de881870e89c0559238b5e45ec1a197b819b0d76ad1bbeb36732232bcd9ce3_arm64","vendor":{"name":"Red Hat"}}},{"id":"c284f1dc-3f72-36b2-9f8e-79802f2494d2","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel10@sha256:6c9d48d718885dfb5ab96e434f2b6cf1006a878c36595020cf57a8b24108affd_arm64","vendor":{"name":"Red Hat"}}},{"id":"c43bccd8-f7cb-3994-8370-e5ababa647b6","product":{"name":"registry.redhat.io/rhceph/grafana-rhel10@sha256:0fa88412ee250b79e9af3c426d74d2e838342fda5ebe1b99662ae3368ec2b480_amd64","vendor":{"name":"Red Hat"}}},{"id":"cc0e73e7-76fc-3507-be44-b0bc709d6382","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:1cb7e79a5c02999ac479fdd43fa2b99c5ad88b7211e7ad8142cdfce833e83e7e_arm64","vendor":{"name":"Red Hat"}}},{"id":"d830d27b-c549-3f8e-8d57-af9a9164a474","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel10@sha256:972e07ea652e5c12087fdfa32d1aba063ceb507e7b36ed55f2e54d46c663fce3_arm64","vendor":{"name":"Red Hat"}}}]}}]}