Loading vulnerability…
CVE-2025-27152 is a server-side request forgery vulnerability in the Axios HTTP client library caused by improper handling of absolute URLs when a baseURL is configured. When an application passes an absolute URL to Axios instead of a protocol-relative or intended relative path, Axios sends the request to the attacker-specified absolute destination rather than constraining it to the configured baseURL. This behavior can defeat application assumptions that baseURL restricts outbound requests to a trusted origin. In affected deployments, this can result in SSRF against internal or external targets and can also leak sensitive request material, including authorization headers or other credentials, to an unintended host. The issue affects both server-side and client-side usage of Axios and is fixed in Axios 1.8.2; advisory data also indicates older release lines should be updated to 0.30.0 or later where applicable.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains two HTML/JavaScript proof-of-concept files demonstrating CVE-2025-27152, a credential leak vulnerability in Axios v1.6.8 when used in a browser context. Both files create an Axios client with a preset baseURL, and in the case of 'axios-credsteal.html', also set an Authorization header and enable withCredentials. The user is prompted to enter an absolute URL, which is then used as the target for an Axios GET request. This allows an attacker to supply a malicious endpoint (such as a webhook or controlled server) and receive sensitive credentials (headers and cookies) from the victim's browser. The exploit demonstrates how improper handling of absolute URLs in Axios can lead to credential leakage across origins. The repository is structured as two standalone HTML files, each serving as an independent PoC for the vulnerability.
This repository is a full-stack demonstration application (Angular frontend, NestJS backend) designed to showcase two specific vulnerabilities: SSRF (Server-Side Request Forgery) and Path Traversal, specifically in the context of the axios library (version 1.8.1, vulnerable to CVE-2025-27152). The backend exposes API endpoints for movie data, using axios to interact with the external TMDB API. The SSRF vulnerability is present in the backend's search functionality, where user-supplied input is used in requests to external URLs via axios. The Path Traversal vulnerability is present in the downloads middleware, which allows crafted URLs to access files outside the intended directory (e.g., '/api/downloads/linda/..%2f..%2f..%2fdist%2fmain.ts'). The README provides explicit instructions for exploiting both vulnerabilities. The repository is structured into 'backend' (NestJS API) and 'frontend' (Angular app) directories, with supporting configuration and test files. The main entry points for exploitation are the backend API endpoints, which can be accessed directly or via the frontend. The code is intended for educational and demonstration purposes, not as a weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An SSRF vulnerability in Axios caused by improper URL parsing when absolute URLs were passed to the library.
A denial-of-service vulnerability in the brace-expansion library where a zero step value in a brace pattern can trigger an infinite loop and excessive memory allocation, causing the process to hang.
A vulnerability in the Axios HTTP client library that can lead to server-side request forgery (SSRF) risks; the content states Storm-2755 appears to exploit it as part of its AiTM relay flow.
A vulnerability in the Axios HTTP client that can lead to server-side request forgery (SSRF); the content suggests Storm-2755 may have leveraged it as part of its AiTM attack path.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.