Home / Vulnerability Intelligence / CVE-2026-40175

CVE-2026-40175 - Vulnerability Analysis

CriticalCVSS: 10.0

Last Updated: April 10, 2026

Axios - Prototype Pollution

Published: April 10, 2026Updated: April 10, 2026Remote Exploitable

Overview

Axios < 1.15.0 contains a prototype pollution vulnerability in third-party dependencies, letting attackers escalate to remote code execution or full cloud compromise via AWS IMDSv2 bypass, exploit requires vulnerable dependency usage.

Severity & Score

Severity: Critical

CVSS Score: 10.0

Impact

Attackers can achieve remote code execution or full cloud compromise by exploiting prototype pollution in dependencies.

Mitigation

Update to version 1.15.0 or later.

References

https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
https://github.com/axios/axios/pull/10660
https://github.com/axios/axios/releases/tag/v1.15.0

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-40175
Severity: Critical
CVSS Score: 10.0
Type: prototype_pollution
Status: new

CWE

CWE-113

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H