Loading vulnerability…
CVE-2025-27152 is a server-side request forgery and credential leakage vulnerability in the Axios HTTP client. When an absolute URL is passed to a request method, Axios sends the request to that destination even when baseURL is configured. Applications that rely on baseURL to constrain destinations can therefore send requests and sensitive headers to unintended hosts if an attacker controls the supplied URL. The issue affects both server-side and browser usage. Fixes are available in Axios 1.8.2 and 0.30.0.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains two HTML/JavaScript proof-of-concept files demonstrating CVE-2025-27152, a credential leak vulnerability in Axios v1.6.8 when used in a browser context. Both files create an Axios client with a preset baseURL, and in the case of 'axios-credsteal.html', also set an Authorization header and enable withCredentials. The user is prompted to enter an absolute URL, which is then used as the target for an Axios GET request. This allows an attacker to supply a malicious endpoint (such as a webhook or controlled server) and receive sensitive credentials (headers and cookies) from the victim's browser. The exploit demonstrates how improper handling of absolute URLs in Axios can lead to credential leakage across origins. The repository is structured as two standalone HTML files, each serving as an independent PoC for the vulnerability.
This repository is a full-stack demonstration application (Angular frontend, NestJS backend) designed to showcase two specific vulnerabilities: SSRF (Server-Side Request Forgery) and Path Traversal, specifically in the context of the axios library (version 1.8.1, vulnerable to CVE-2025-27152). The backend exposes API endpoints for movie data, using axios to interact with the external TMDB API. The SSRF vulnerability is present in the backend's search functionality, where user-supplied input is used in requests to external URLs via axios. The Path Traversal vulnerability is present in the downloads middleware, which allows crafted URLs to access files outside the intended directory (e.g., '/api/downloads/linda/..%2f..%2f..%2fdist%2fmain.ts'). The README provides explicit instructions for exploiting both vulnerabilities. The repository is structured into 'backend' (NestJS API) and 'frontend' (Angular app) directories, with supporting configuration and test files. The main entry points for exploitation are the backend API endpoints, which can be accessed directly or via the frontend. The code is intended for educational and demonstration purposes, not as a weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An SSRF vulnerability in Axios caused by improper URL parsing when absolute URLs were passed to the library.
A denial-of-service vulnerability in the brace-expansion library where a zero step value in a brace pattern can trigger an infinite loop and excessive memory allocation, causing the process to hang.
A vulnerability in the Axios HTTP client library that can lead to server-side request forgery (SSRF) risks; the content states Storm-2755 appears to exploit it as part of its AiTM relay flow.
A vulnerability in the Axios HTTP client that can lead to server-side request forgery (SSRF); the content suggests Storm-2755 may have leveraged it as part of its AiTM attack path.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.