CVE-2026-40175

CVE Details

Release Date:	2026-04-10
Impact:	Important	What is this?

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.

See more information about CVE-2026-40175 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	9.0
Vector String:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	None
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (ol-automation-manager)	OLAMSA-2026-0009	2026-04-30
Oracle Linux version 8 (python-aiohttp)	OLAMSA-2026-0009	2026-04-30
Oracle Linux version 8 (python-django)	OLAMSA-2026-0009	2026-04-30
Oracle Linux version 8 (python-galaxy-ng)	OLAMSA-2026-0009	2026-04-30
Oracle Linux version 9 (ol-automation-manager)	OLAMSA-2026-0010	2026-04-30
Oracle Linux version 9 (python-aiohttp)	OLAMSA-2026-0010	2026-04-30
Oracle Linux version 9 (python-django)	OLAMSA-2026-0010	2026-04-30
Oracle Linux version 9 (python-galaxy-ng)	OLAMSA-2026-0010	2026-04-30