CVE-2026-42042 - Vulnerability Analysis

Overview

Axios < 1.15.1 and < 0.31.1 contains a cross-site request forgery caused by improper truthy/falsy check of withXSRFToken config, letting attackers receive XSRF tokens on cross-origin requests, exploit requires attacker to control or misconfigure withXSRFToken property.

Severity & Score

Impact

Attackers can steal XSRF tokens by causing them to be sent to malicious cross-origin servers, enabling CSRF attacks.

Mitigation

Update to version 1.15.1 or 0.31.1 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner