Bulmax9797-Sketch

**Name of the Vulnerable Software and Affected Versions** Axios versions 1.0.0 through 1.15.1 **Description** Axios is a promise-based HTTP client for the browser and Node.js. The HTTP adapter reads five configuration properties—`auth`, `baseURL`, `socketPath`, `beforeRedirect`, and `insecureHTTPParser`—via direct property access without using hasOwnProperty guards. This allows these properties to act as prototype pollution gadgets. If Object.prototype is polluted by another dependency within the same process, Axios will silently use these polluted values for every outbound HTTP request. Prototype pollution is a vulnerability where an attacker can manipulate the prototype of a base object, leading to the injection of properties into all objects inheriting from that prototype. **Recommendations** Update to version 1.15.2.

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, in src/endpoints/search.js, the hostname is checked against /^d+.d+.d+.d+$/. This only matches literal dotted-quad IPv4 (e.g. 127.0.0.1, 10.0.0.1). It does not catch: localhost (hostname, not dotted-quad), [::1] (IPv6 loopback), and DNS names resolving to internal addresses (e.g. localtest.me -> 127.0.0.1). A separate port check (urlObj.port !== '') limits exploitation to services on default ports (80/443), making this lower severity than a fully unrestricted SSRF. This issue has been patched in version 1.17.0.