Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p78g-vmhn-yyck
Vulnerability ID VCID-p78g-vmhn-yyck
Aliases CVE-2026-42042
GHSA-xx6v-rp6x-q39c
Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1025 Comparison Using Wrong Factors
CWE-183 Permissive List of Allowed Inputs
CWE-201 Insertion of Sensitive Information Into Sent Data
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42042.json
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2026-42042
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2026-42042
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2026-42042
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-xx6v-rp6x-q39c
cvssv3.1 5.4 https://github.com/axios/axios
generic_textual MODERATE https://github.com/axios/axios
cvssv3.1 5.4 https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
cvssv3.1_qr MODERATE https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
generic_textual MODERATE https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
ssvc Track https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2026-42042
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-42042
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42042.json
https://api.first.org/data/v1/epss?cve=CVE-2026-42042
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42042
https://github.com/axios/axios
1134878 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134878
2461637 https://bugzilla.redhat.com/show_bug.cgi?id=2461637
CVE-2026-42042 https://nvd.nist.gov/vuln/detail/CVE-2026-42042
GHSA-xx6v-rp6x-q39c https://github.com/advisories/GHSA-xx6v-rp6x-q39c
GHSA-xx6v-rp6x-q39c https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42042.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/axios/axios
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-27T17:35:32Z/ Found at https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-42042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07769
EPSS Score 0.00028
Published At April 26, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-25T23:21:55.402691+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.4.0