Automate security testing and vulnerability detection

Oct 13, 2025 by pinkandtrash.com 16 views

CVE-2025-27152 (Medium) Detected in axios-0.22.0.tgz: A Threat to Open Source Security

Introduction

In the ever-evolving landscape of open source software, vulnerabilities can creep in and compromise the security of even the most well-intentioned projects. One such vulnerability, CVE-2025-27152, has been detected in the popular axios library, specifically in the version 0.22.0.tgz. In this article, we will delve into the details of this vulnerability, its impact, and the suggested fix to ensure the security of your open source projects.

CVE-2025-27152 - Medium Severity Vulnerability

The axios library is a promise-based HTTP client for both the browser and node.js. However, a critical issue has been identified in the version 0.22.0.tgz, which can lead to Server-Side Request Forgery (SSRF) and credential leakage. This vulnerability occurs when passing absolute URLs rather than protocol-relative URLs to axios, even if the baseURL is set. This issue affects both server-side and client-side usage of axios.

Vulnerable Library Details

Vulnerable Library: axios-0.22.0.tgz
Library Home Page: https://registry.npmjs.org/axios/-/axios-0.22.0.tgz
Path to Dependency File: /package.json
Path to Vulnerable Library: /node_modules/axios/package.json

Dependency Hierarchy

The axios library is part of the f95api-2.0.0-beta.10.1.tgz (Root Library) dependency hierarchy.

f95api-2.0.0-beta.10.1.tgz (Root Library)
- axios-0.22.0.tgz (Vulnerable Library)

Found in Base Branch

The vulnerability was found in the main branch of the project.

Vulnerability Details

The axios library is designed to handle HTTP requests in a promise-based manner. However, the issue arises when passing absolute URLs to axios, which can lead to SSRF and credential leakage. This vulnerability affects both server-side and client-side usage of axios.

Publish Date: 2025-03-07
URL: https://www.mend.io/vulnerability-database/CVE-2025-27152

CVSS 3 Score Details

The CVSS 3 score for this vulnerability is 5.5, indicating a medium severity risk.

Base Score Metrics:
- Exploitability Metrics:
  - Attack Vector: Local
  - Attack Complexity: Low
  - Privileges Required: None
  - User Interaction: Required
  - Scope: Unchanged
- Impact Metrics:
  - Confidentiality Impact: None
  - Integrity Impact: None
  - Availability Impact: High

Suggested Fix

The suggested fix for this vulnerability is to upgrade the axios library to version 1.8.2 or later.

Type: Upgrade version
Origin: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
Release Date: 2025-03-07
Fix Resolution: 1.8.2

Conclusion

The detection of CVE-2025-27152 in the axios library highlights the importance of regular security audits and vulnerability assessments in open source projects. By staying up-to-date with the latest security patches and fixes, developers can ensure the security and integrity of their projects. In this article, we have provided a detailed overview of the vulnerability, its impact, and the suggested fix. We hope that this information will help developers take proactive steps to secure their open source projects.

Step Up Your Open Source Security Game with Mend

To stay ahead of the curve in open source security, consider using Mend's full solution for GitHub. With Mend, you can:

Automate security testing and vulnerability detection
Get real-time alerts and notifications for security issues
Prioritize and remediate security vulnerabilities
Improve your open source security posture

Learn more about Mend's full solution for GitHub and take the first step towards securing your open source projects.
CVE-2025-27152 (Medium) Detected in axios-0.22.0.tgz: A Threat to Open Source Security - Q&A

Introduction

In our previous article, we discussed the detection of CVE-2025-27152 in the axios library, specifically in the version 0.22.0.tgz. This vulnerability can lead to Server-Side Request Forgery (SSRF) and credential leakage, affecting both server-side and client-side usage of axios. In this Q&A article, we will address some of the most frequently asked questions about this vulnerability and provide additional insights to help developers understand and mitigate the risks.

Q&A

Q: What is CVE-2025-27152, and how does it affect axios?

A: CVE-2025-27152 is a medium severity vulnerability detected in the axios library, specifically in the version 0.22.0.tgz. This vulnerability occurs when passing absolute URLs rather than protocol-relative URLs to axios, even if the baseURL is set. This can lead to SSRF and credential leakage, affecting both server-side and client-side usage of axios.

Q: What is Server-Side Request Forgery (SSRF), and how does it relate to CVE-2025-27152?

A: SSRF is a type of attack where an attacker can trick a web application into making requests to unintended destinations, potentially leading to sensitive data exposure or unauthorized access. In the case of CVE-2025-27152, the vulnerability can be exploited to perform SSRF attacks, allowing attackers to access sensitive data or perform unauthorized actions.

Q: How can I identify if my project is affected by CVE-2025-27152?

A: To identify if your project is affected by CVE-2025-27152, you can check the following:

Verify if your project uses the axios library version 0.22.0.tgz or earlier.
Check if your project passes absolute URLs to axios, even if the baseURL is set.
Review your project's code to ensure that it does not use the vulnerable axios version.

Q: What is the suggested fix for CVE-2025-27152?

A: The suggested fix for CVE-2025-27152 is to upgrade the axios library to version 1.8.2 or later. This version includes a fix for the vulnerability, ensuring that axios handles absolute URLs correctly and preventing SSRF and credential leakage.

Q: How can I prevent similar vulnerabilities in the future?

A: To prevent similar vulnerabilities in the future, consider the following best practices:

Regularly update your dependencies to ensure you have the latest security patches.
Use a secure coding practice, such as using protocol-relative URLs instead of absolute URLs.
Implement a robust security testing and vulnerability detection process.
Stay informed about the latest security vulnerabilities and patches.

Q: What resources are available to help me understand and mitigate CVE-2025-27152?

A: The following resources are available to help you understand and mitigate CVE-2025-27152:

The official axios documentation, which includes information on the vulnerability and the suggested fix.
The CVE-2025-27152 entry on the National Vulnerability Database (NVD), which provides detailed information on the vulnerability.
The Mend blog, which includes articles and guides on open source security and vulnerability management.

Conclusion

CVE-2025-27152 is a significant vulnerability that affects the axios library, specifically in the version 0.22.0.tgz. By understanding the vulnerability and its impact, developers can take proactive steps to secure their projects and prevent similar vulnerabilities in the future. We hope that this Q&A article has provided valuable insights and information to help developers mitigate the risks associated with CVE-2025-27152.

Step Up Your Open Source Security Game with Mend

To stay ahead of the curve in open source security, consider using Mend's full solution for GitHub. With Mend, you can:

Automate security testing and vulnerability detection
Get real-time alerts and notifications for security issues
Prioritize and remediate security vulnerabilities
Improve your open source security posture

Learn more about Mend's full solution for GitHub and take the first step towards securing your open source projects.