PT-2025-3674 · Npm+1 · Axios+1

Published 2025-01-29 · Updated 2026-01-16 · CVE-2024-57965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions axios versions prior to 1.7.8

Description The issue is related to the isURLSameOrigin.js file in the axios library, which does not use a URL object when determining an origin and has a potentially unwanted setAttribute('href', href) call. Some parties believe that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.

Recommendations For versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue. As a temporary workaround, consider disabling the isURLSameOrigin.js function until a patch is available. Restrict access to the lib/helpers/isURLSameOrigin.js file to minimize the risk of exploitation. Avoid using the href attribute in the affected API endpoints until the issue is resolved.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-57965

Affected Products

Debian

Axios

References · 18

• https://github.com/axios/axios/pull/6714 · Patch
• https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-57965 · Security Note
• https://ubuntu.com/security/CVE-2024-57965 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-57965 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57965 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-57965 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-57965 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-57965 · Vendor Advisory
• https://github.com/axios/axios/releases/tag/v1.7.8 · Note
• https://github.com/axios/axios/issues/6351 · Note
• https://reddit.com/r/Operatingsystems/comments/1jcy1dr/debian_12100_released · Reddit Post
• https://t.me/cvenotify/108955 · Telegram Post
• https://t.me/cvedetector/16674 · Telegram Post
• https://t.me/cveNotify/136005 · Telegram Post