-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(deps): update dependency axios to v1.8.2 [security] #595
base: main
Are you sure you want to change the base?
Conversation
9eb3195
to
4413322
Compare
4413322
to
9ed283a
Compare
Kudos, SonarCloud Quality Gate passed! |
9ed283a
to
76fddd1
Compare
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is a critical CVE?Contains a Critical Common Vulnerability and Exposure (CVE). Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
76fddd1
to
3638b1b
Compare
3638b1b
to
4c97754
Compare
4c97754
to
bdc8091
Compare
bdc8091
to
1540fcc
Compare
|
1540fcc
to
4d2cec5
Compare
|
4d2cec5
to
d21e195
Compare
d21e195
to
19ba76d
Compare
19ba76d
to
e393293
Compare
|
e393293
to
ac04e04
Compare
ac04e04
to
8ed3208
Compare
8ed3208
to
55d0bf9
Compare
55d0bf9
to
5fb9d0d
Compare
5fb9d0d
to
8918768
Compare
|
This PR contains the following updates:
1.5.1
->1.8.2
GitHub Vulnerability Alerts
CVE-2023-45857
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVE-2024-39338
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVE-2025-27152
Summary
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery).
Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if
baseURL
is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.Details
Consider the following code snippet:
In this example, the request is sent to
http://attacker.test/
instead of thebaseURL
. As a result, the domain owner ofattacker.test
would receive theX-API-KEY
included in the request headers.It is recommended that:
baseURL
is set, passing an absolute URL such ashttp://attacker.test/
toget()
should not ignorebaseURL
.baseURL
with the user-provided parameter), axios should verify that the resulting URL still begins with the expectedbaseURL
.PoC
Follow the steps below to reproduce the issue:
Even though
baseURL
is set tohttp://localhost:10001/
, axios sends the request tohttp://localhost:10002/
.Impact
baseURL
and does not validate path parameters is affected by this issue.Release Notes
axios/axios (axios)
v1.8.2
Compare Source
Bug Fixes
Contributors to this release
v1.8.1
Compare Source
Bug Fixes
generateString
to platform utils to avoid importing crypto module into client builds; (#6789) (36a5a62)Contributors to this release
v1.8.0
Compare Source
Bug Fixes
Features
Reverts
BREAKING CHANGES
code relying on the above will now combine the URLs instead of prefer request URL
feat: add config option for allowing absolute URLs
fix: add default value for allowAbsoluteUrls in buildFullPath
fix: typo in flow control when setting allowAbsoluteUrls
Contributors to this release
1.7.9 (2024-12-04)
Reverts
Contributors to this release
1.7.8 (2024-11-25)
Bug Fixes
globalThis.TextEncoder
when available (#6634) (df956d1)Contributors to this release
1.7.7 (2024-08-31)
Bug Fixes
Contributors to this release
1.7.6 (2024-08-30)
Bug Fixes
Contributors to this release
1.7.5 (2024-08-23)
Bug Fixes
ReferenceError: navigator is not defined
for custom environments; (#6567) (fed1a4b)Contributors to this release
1.7.4 (2024-08-13)
Bug Fixes
Contributors to this release
1.7.3 (2024-08-01)
Bug Fixes
Contributors to this release
1.7.2 (2024-05-21)
Bug Fixes
Contributors to this release
1.7.1 (2024-05-20)
Bug Fixes
Contributors to this release
v1.7.9
Compare Source
Reverts
Contributors to this release
v1.7.8
Compare Source
Bug Fixes
globalThis.TextEncoder
when available (#6634) (df956d1)Contributors to this release
v1.7.7
Compare Source
Bug Fixes
Contributors to this release
v1.7.6
Compare Source
Bug Fixes
Contributors to this release
v1.7.5
Compare Source
Bug Fixes
ReferenceError: navigator is not defined
for custom environments; (#6567) (fed1a4b)Contributors to this release
v1.7.4
Compare Source
Bug Fixes
Contributors to this release
v1.7.3
Compare Source
Bug Fixes
Contributors to this release
v1.7.2
Compare Source
Bug Fixes
Contributors to this release
v1.7.1
Compare Source
Bug Fixes
Contributors to this release
v1.7.0
Compare Source
Features
Bug Fixes
Contributors to this release
v1.6.8
Compare Source
Bug Fixes
Contributors to this release
v1.6.7
Compare Source
Bug Fixes
Contributors to this release
v1.6.6
Compare Source
Bug Fixes
Contributors to this release
v1.6.5
Compare Source
Bug Fixes
Contributors to this release
v1.6.4
Compare Source
Bug Fixes
Contributors to this release
v1.6.3
Compare Source
Bug Fixes
Contributors to this release
v1.6.2
Compare Source
Features
withCredentials
behavior; (#6046) (cff9967)PRs
Contributors to this release
v1.6.1
Compare Source
Bug Fixes
Contributors to this release
PRs
v1.6.0
Compare Source
Bug Fixes
PRs
Contributors to this release
1.5.1 (2023-09-26)
Bug Fixes
Content-Type
header for FormData in non-browser environments; (#5917) (bc9af51)content-encoding
header to handle case-insensitive values (#5890) (#5892) (4c89f25)Contributors to this release
PRs
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.