PT-2026-21525 · Axios+1 · Axios+1

Published 2026-02-23 · Updated 2026-02-28 · CVE-2025-70058

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions YMFE yapi version 1.12.0

Description The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests. This can lead to man-in-the-middle attacks where a malicious actor can intercept and potentially modify communications between the application and a server.

Recommendations Ensure TLS/SSL certificate validation is enabled by setting 'rejectUnauthorized': true in the HTTPS agent configuration for Axios requests.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-70058

GHSA-663H-2VR3-GHRJ

Affected Products

Axios

Yapi

References · 11

• https://osv.dev/vulnerability/CVE-2025-70058 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-663h-2vr3-ghrj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70058 · Security Note
• https://github.com/YMFE/yapi/blob/59bade3a8a43e7db077d38a4b0c7c584f30ddf8c/common/postmanLib.js#L110 · Note
• https://github.com/YMFE/yapi · Note
• https://twitter.com/CVEnew/status/2026265053201059942 · Twitter Post
• https://twitter.com/cracbot/status/2027338079401558162 · Twitter Post
• https://gist.github.com/zcxlighthouse/11c53803faf23f607c2787c166e811d4 · Note
• https://github.com/YMFE · Note
• https://twitter.com/cracbot/status/2027700379971117114 · Twitter Post
• https://t.me/CVEtracker/45503 · Telegram Post