In axios versions before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href', href) call. This can lead to:
- Cross-origin request vulnerabilities
- Potential CSRF attacks
- DOM-based security issues
- Authentication bypass risks
The vault-api package currently depends on axios ^0.21.4, which contains a critical security vulnerability (CVE-2024-57965) with a CVSS score of 9.8.
Vulnerability Details
- CVE ID: CVE-2024-57965
- Severity: Critical
- CVSS v3 Score: 9.8
- Affected Version: axios < 1.7.8
- Fixed Version: axios >= 1.7.8
- Published: November 26, 2024
In axios versions before 1.7.8,
lib/helpers/isURLSameOrigin.jsdoes not use a URL object when determining an origin, and has a potentially unwantedsetAttribute('href', href)call. This can lead to:The
vault-apipackage currently depends onaxios ^0.21.4, which contains a critical security vulnerability (CVE-2024-57965) with a CVSS score of 9.8.Vulnerability Details