The race condition in axios4go's shared HTTP client causes the global defaultClient to be mutated without synchronization during request execution, altering the Transport, Timeout and CheckRedirect fields. In concurrent goroutine requests that supply different proxy configurations, this can cause one request to observe another request’s proxy settings, which may include authentication credentials or tokens, leading to accidental leakage of sensitive information. The flaw is a classic race condition, classified as CWE-362.

All Go applications that import rezmoss/axios4go and use a version earlier than 0.6.4 are impacted. The issue specifically affects code paths that perform concurrent GetAsync, PostAsync or other async calls and provide distinct proxy settings for each request, as the shared client is mutated globally.

With a CVSS score of 8.2 the vulnerability is high severity, but the EPSS calculation of <1% indicates a low likelihood of current exploitation. It is not listed in the CISA KEV catalog, meaning no widespread attacks have been observed. Exploitation requires an attacker who can influence concurrent goroutine requests and supply varied proxy configurations; therefore the attack vector is inferred from the concurrency behavior described in the vulnerability.