Axios versions from 1.0.0 up to 1.15.1 allow certain configuration properties in the HTTP adapter to be read without ownership checks. In the presence of a polluted Object.prototype, these values can be overridden, enabling an attacker to inject credentials or hijack outgoing requests. This prototype pollution weakness (CWE-1321) can compromise confidentiality and integrity of requests.

The affected vendor is Axios. Products are the axios HTTP client library from version 1.0.0 through 1.15.1. The patch was released in version 1.15.2.

The CVSS score of 7.4 indicates a high severity vulnerability. EPSS data is unavailable, so the likelihood of exploitation cannot be precisely quantified, and it is not listed in the CISA KEV catalog. The likely attack vector requires that an attacker can influence the dependency chain or inject code into the same process that modifies Object.prototype, after which contaminated values will be reused by Axios on every outbound request.