Axios library between versions 1.0.0 and before 1.15.2 contains a prototype pollution gadget. The default transformResponse uses JSON.parse with a reviver taken from the request configuration. Because the parseReviver property is not validated or constrained, a polluted Object.prototype.parseReviver function will be invoked for every key–value pair in a JSON response. This allows an attacker who can inject prototype pollution into the dependency tree to surgically modify responses, potentially altering balances, bypassing authorization, or escalating privileges, while leaving the rest of the data unchanged.

Axios, a promise‑based HTTP client for browsers and Node.js, is affected in versions 1.0.0 through 1.15.1. The vulnerability exists in the library's configuration handling before the 1.15.2 release. All users of Axios in either environment that have not upgraded are impacted.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is below 1%, implying a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attack requires an adversary to introduce prototype pollution into Axios' dependency tree so that a malicious Object.prototype.parseReviver function is executed during JSON parsing. Once in place, the attacker can alter any response value while keeping other data intact.