CVE-2026-67315

Katalog CVE

CVSS 7.5 · High EPSS 0,46%

Kerentanan Permissive List of Allowed Inputs pada axios. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-183: Permissive List of Allowed Inputs

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548 exploit · mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via advisory pihak ketiga