PT-2026-2093 · Axios4Go · Axios4Go

Rezmoss · Publicado 2026-01-07 · Atualizado 2026-03-09 · CVE-2026-21697

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions axios4go versions prior to 0.6.4

Description axios4go is a Go HTTP client library affected by a race condition in its shared HTTP client configuration. The global defaultClient is modified during request execution without proper synchronization, altering the shared http.Client's Transport, Timeout, and CheckRedirect properties. Applications using axios4go with concurrent requests (multiple goroutines, GetAsync, PostAsync, etc.), different proxy configurations, or handling sensitive data like authentication credentials and API keys are potentially impacted. The vulnerability allows for potential proxy configuration leaks.

Recommendations Versions prior to 0.6.4 should be updated to version 0.6.4 or later.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2026-21697

GHSA-CMJ9-27WJ-7X47

Produtos afetados

Axios4Go

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21697.json · Exploit
• https://github.com/rezmoss/axios4go/commit/b651604c64e66a115ab90cdab358b0181d74a842 · Correção
• https://github.com/rezmoss/axios4go/security/advisories/GHSA-cmj9-27wj-7x47 · Aviso do Fabricante
• https://github.com/rezmoss/axios4go/releases/tag/v0.6.4 · Nota
• https://t.me/CVEtracker/41656 · Publicação no Telegram
• https://t.me/cveNotify/154790 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21697 · Nota de Segurança
• https://twitter.com/dailycve/status/2031040077200081040 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009032505706565962 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21697 · Aviso do Fabricante
• https://t.me/cveNotify/148009 · Publicação no Telegram