Axios uses JavaScript truthy/falsy semantics for the withXSRFToken configuration property instead of strict boolean comparison. When this property is set to any truthy non‑boolean value, whether through prototype pollution or a misconfiguration, Axios suppresses the same‑origin verification causing the XSRF token to be included in every request—including to cross‑origin endpoints. The attacker receives the victim’s XSRF token, which can be reused for forgery or token theft, compromising the confidentiality of anti‑CSRF measures and potentially facilitating more advanced credential‑stealing or CSRF attacks.

Affecting the Axios library required for both browser and Node.js environments. Versions before 1.15.1 for browser support and before 0.31.1 for Node.js are vulnerable. The issue originates from the way Axios processes the withXSRFToken property, not from the host runtime.

The CVSS score of 5.4 reflects moderate severity, while an EPSS score below 1 % indicates a very low, but not zero, likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Attackers could gain the victim’s XSRF token by injecting prototype pollution or misconfiguring the withXSRFToken setting. With the token in hand, they could craft malicious requests to the victim’s application or leverage it for other CSRF or credential‑stealing activities.