Axios CVE-2026-42042

Exploitation requires one of the following specific conditions: (1) The consuming application is vulnerable to prototype pollution, and the attacker can inject a truthy non-boolean value into Object.prototype.withXSRFToken or directly into the Axios config object's withXSRFToken property, OR (2) A developer explicitly misconfigures withXSRFToken with a non-boolean truthy value such as a string (e.g., config.withXSRFToken = 'true' or 'always') or a number, instead of the intended boolean true. Additionally, user interaction is required-the vulnerability only manifests when the user triggers an Axios-based HTTP request, such as submitting a form or clicking a link that initiates a network call. The attacker must also control a cross-origin server endpoint to receive the exfiltrated token. Default Axios configurations (withXSRFToken not explicitly set) are not directly vulnerable under normal circumstances; the vulnerability requires either misconfiguration or a chained prototype pollution vulnerability to activate.

This vulnerability presents moderate real-world risk despite a CVSS score of 5.4 (medium). The attack vector is network-based with low complexity and no required privilege escalation, but requires user interaction (UI:R), which limits widespread automated exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates confidentiality and integrity impacts within the same scope-specifically token disclosure and potential request forgery. The practical exploitation path requires either: (1) a prototype pollution vulnerability in the consuming application to inject a truthy value into withXSRFToken, or (2) misconfiguration by developers who explicitly set withXSRFToken to a non-boolean truthy value. No public exploit code has been identified at the time of analysis, and CISA KEV status is not confirmed. The vulnerability's impact depends heavily on whether XSRF tokens contain sensitive information (e.g., session identifiers or long-lived secrets) that an attacker could exfiltrate to a cross-origin endpoint. Applications that rotate XSRF tokens frequently or use short-lived, single-use tokens experience reduced practical risk. The UI requirement (user must trigger the request) and reliance on misconfiguration or chaining with prototype pollution make this a secondary vulnerability rather than a primary attack vector. Organizations using Axios should prioritize patching only if they: (1) use custom withXSRFToken configuration, (2) are vulnerable to prototype pollution attacks, or (3) store long-lived sensitive data in XSRF tokens.

An attacker identifies that a web application uses Axios and is vulnerable to prototype pollution via a user-controlled query parameter or form input. The attacker crafts a malicious request containing prototype pollution payload that sets Object.prototype.withXSRFToken to 'bypass' (a truthy non-boolean string). When a legitimate user visits the application, their browser loads the poisoned JavaScript context. When the user triggers any Axios HTTP request (e.g., submitting a form or clicking a button), Axios checks the withXSRFToken property. Due to the truthy/falsy evaluation, it sees 'bypass' as truthy, skips the same-origin check, and appends the XSRF token from the cookie to the request. The attacker has set up a cross-origin endpoint under their control as the request target, and the token is transmitted in plaintext to the attacker's server, compromising the user's CSRF protection.